Executive brief
Apache APISIX, a popular cloud-native API gateway used to manage and secure web traffic, contains a security flaw in its HMAC authentication plugin. An attacker can capture a valid authentication token and reuse it indefinitely, even after it should have expired. This could allow unauthorized individuals to maintain persistent access to protected internal services and data.
Technical details
An authentication bypass by capture-replay (CWE-294) exists in Apache APISIX within the hmac-auth plugin. The vulnerability stems from specific configurations that fail to properly invalidate or expire tokens, allowing an attacker to reuse a captured HMAC token indefinitely. This bypasses the intended security controls designed to limit the lifespan of authentication credentials. The issue is reachable over the network without prior authentication, provided the hmac-auth plugin is active and misconfigured. Users are advised to upgrade to version 3.17.0 to remediate this flaw.
Affected products
- Apache Software Foundation APISIX 3.11.0 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 3.17.0