CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a forwardheader distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allowdegradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/apisixto a version that resolves this vulnerability.Fixed in 3.20.0
Event History
Frequently Asked Questions
Which APISIX deployments are exposed to this issue?
Affected versions are Apache APISIX 3.18.0 through 3.19.0. Exposure requires either a route using jwe-decrypt with strict set to false and a forward_header different from the token header, or forward-auth configured with allow_degradation set to true.
What must an attacker do to exploit the jwe-decrypt case?
An unauthenticated client can supply a value in the identity header that the upstream application treats as gateway-decrypted plaintext. This applies when the route's jwe-decrypt configuration uses strict: false and its forward_header differs from the token header.
When does the forward-auth configuration become vulnerable?
The forward-auth case can occur when allow_degradation is true and the authentication service is unavailable. Under those conditions, a client-supplied identity header may be passed through.
How should affected deployments be remediated?
Upgrade Apache APISIX to version 3.20.0, which fixes the issue. If an immediate upgrade is not possible, avoid the affected jwe-decrypt configuration and do not enable forward-auth degradation where an unavailable auth service could allow client-supplied identity headers through.