Executive brief
Apache APISIX, a popular API gateway used to manage and secure web traffic, contains a vulnerability in its JWT authentication plugin. An attacker can exploit specific configurations to bypass security checks and gain unauthorized access to protected internal services. This could lead to the exposure of sensitive data or unauthorized operations within a company's infrastructure.
Technical details
An authentication bypass vulnerability exists in Apache APISIX versions 2.2 through 3.16.0 within the jwt-auth plugin. The flaw is characterized as an 'Authentication Bypass by Spoofing' (CWE-290), specifically involving JWT algorithm confusion. When certain configurations are present, an attacker can craft a malicious token that the gateway incorrectly validates, allowing them to bypass authentication entirely. This is a network-reachable vulnerability that requires no prior privileges. Users are advised to upgrade to version 3.17.0 (or 3.16.1 as noted in some advisory text) to remediate the issue.
Affected products
- Apache APISIX 2.2 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory