CVE-2026-124679 in APISIX
Summary
by MITRE • 11/13/2026
Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Apache APISIX versions ranging from 3.18.0 through 3.19.0 represents a critical authentication bypass mechanism rooted in improper handling of JSON Web Encryption (JWE) decryption parameters and forward authorization configurations. This flaw allows unauthenticated clients to manipulate the request context such that the upstream service processes data as if it had been legitimately authenticated by the gateway, effectively circumventing security controls designed to restrict access based on identity verification. The core technical deficiency lies in how APISIX manages the separation between decrypted token payloads and forwarded authentication headers when specific configuration flags are enabled.
In scenarios where routes utilize the jwe-decrypt plugin with the strict parameter set to false, combined with a forward_header setting that differs from the standard token header, an attacker can exploit this misconfiguration. By supplying crafted values in the designated forward header, the client forces APISIX to treat these spoofed values as valid gateway-decrypted plaintext. This occurs because the loose validation mode permits inputs that do not strictly conform to expected cryptographic structures or origin constraints, allowing malicious actors to inject arbitrary data into headers that downstream services trust implicitly. The upstream application receives this manipulated header and interprets it as a legitimate authentication token derived from the JWE decryption process, thereby granting unauthorized access without requiring valid credentials.
A similar attack vector exists when the forward-auth plugin is configured with allow_degradation set to true while the designated authentication service becomes unavailable or unreachable. In such degradation modes, APISIX may default to permissive behavior to maintain availability, but this fallback mechanism lacks sufficient validation checks. An unauthenticated client can exploit this state by sending requests that trigger the degraded path, causing the gateway to accept spoofed headers as valid authenticated contexts. This dual-path vulnerability ensures that regardless of whether the system is operating under loose decryption rules or during a service outage with degradation enabled, an attacker can bypass authentication controls through header manipulation rather than cryptographic breaking.
The operational impact of this vulnerability is severe, as it directly undermines the integrity of identity verification mechanisms within microservices architectures protected by APISIX. Attackers who successfully exploit this flaw gain unauthorized access to sensitive endpoints and data resources that should be restricted to authenticated users only. This can lead to full account takeover, exposure of confidential business information, or further lateral movement into internal network segments depending on the privileges associated with the spoofed identity. Since many upstream services rely entirely on headers provided by API gateways for trust decisions without performing independent validation, this bypass effectively renders authentication controls useless for affected routes.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity within the Common Weakness Enumeration framework. The exploitation technique corresponds to ATT&CK T1078 Valid Accounts or potentially T1621 Multi-Factor Request Interception depending on implementation specifics, as it involves substituting legitimate authentication artifacts with forged ones that are accepted by downstream systems due to configuration errors rather than cryptographic failures. Understanding these mappings helps security teams prioritize remediation efforts and align patching strategies with established threat intelligence models.
To mitigate this risk, organizations running Apache APISIX versions 3.18.0 through 3.19.0 must upgrade immediately to version 3.20.0 or later, where the underlying logic for handling JWE decryption strictness and forward-auth degradation has been corrected to prevent header spoofing. Until upgrading is possible, administrators should review route configurations to ensure that jwe-decrypt plugins are not operating with strict set to false unless absolutely necessary and strictly validated inputs are enforced at the application layer. Additionally, setting allow_degradation in forward-auth configurations to true should be avoided or accompanied by robust fallback authentication mechanisms that do not rely on potentially spoofable headers. Implementing additional validation layers within upstream services to verify token origins independently of gateway-provided headers provides a defense-in-depth strategy against this class of vulnerabilities.