CVE-2026-124679 · Infrastructure
NO FIX YET · SEE WHAT TO DO
On routes using jwe-decrypt with strict set to false and a forward_header different from the token header, an unauthenticated client can supply the value the upstream treats as decrypted plaintext. A similar bypass exists when forward-auth runs with allow_degradation set to true and the auth service is unavailable.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of Apache APISIX from 3.18.0 through 3.19.0 that use the jwe-decrypt plugin with strict set to false and a forward_header distinct from the token header, or forward-auth with allow_degradation enabled while the auth service is down. Routes without these plugin settings are not exposed through this path. Teams on other APISIX versions, or without these settings, can skip it.
Not affected if auth-required, default-config, outside-3.18-3.19
Who cares apache-apisix, api-gateway, kubernetes, self-hosted
jwe-decrypt or forward-auth in APISIX route and plugin configuration.strict is set to false on jwe-decrypt routes.allow_degradation is set to true on forward-auth.apisix version; affected versions are from 3.18.0 through 3.19.0.Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
3.20.0.