Vulnerability · high · CVSS 7.8
Apache APISIX jwe-decrypt and forward-auth client-supplied identity header
Tier B · Patch this week – Put it in the sprint
Who’s exposed: APISIX routes using jwe-decrypt or forward-auth plugins, versions 3.18.0–3.19.0
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
What to do
- Check whether any APISIX 3.18.0 through 3.19.0 deployment uses the jwe-decrypt or forward-auth plugins.
The Brief
- CVE-2026-124679 is an authentication bypass by spoofing in Apache APISIX, reported with a CVSS 4.0 base score of 7.8 (high).
- Per the advisory, on routes using jwe-decrypt or forward-auth, a client-supplied identity header may be passed upstream. Affected versions are 3.18.0 through 3.19.0.
Why it matters
If you run Apache APISIX 3.18.0 through 3.19.0 with jwe-decrypt or forward-auth routes, a remote client may be able to impersonate another identity without authenticating.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Apache APISIX is an API gateway that developers and ops teams run and operate. |
| No | Core infrastructure | Judgment: a single API gateway product, not software nearly every team runs. |
| Yes | Popular tool | Judgment: APISIX is a widely deployed Apache Software Foundation API gateway. |
| No | Exploited in the wild | Open Source Security advisory reports the flaw only; no observed attacks are mentioned. |
| No | Public exploit | Open Source Security advisory describes the bug; no published exploit or PoC is mentioned. |
| Yes | Remote, no login | CVSSCVE-2026-124679: CVSS 7.8 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | Open Source Security advisory reports no data theft or exposure of secrets. |
| No | Supply chain | Open Source Security advisory describes a normal bug in APISIX code, not malicious code shipping. |
| No | No fix yet | Open Source Security lists affected versions 3.18.0 through 3.19.0 but does not state a fixed version or lack of one. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-124679 ↗CVSS 7.8 high AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N
Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-290
Timeline
CVE-2026-124679 disclosed in Open Source Security advisory
Open Source Security
CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
Source
CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided