CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

Summary by Cyber Security News13 Nov 2026, 22:14 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/692

Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 7.8 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N Affected versions: - Apache APISIX 3.18.0 through 3.19.0 Description: Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-124723: Apache APISIX: unauthorized access to mTLS protected resources

CVE-2026-124716: Apache APISIX: authz-keycloak authorization scope mismatch

CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

CVE-2026-124666: Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

CVE-2026-123338: Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch

CVE-2026-123274: Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch