# CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/692) · 2026-11-13 · Security
Page: https://themorning.dev/story/cve-2026-124679-apache-apisix-jwe-decrypt-and-forward-auth-may-pass-a-client-sup-3537cc0a9fc269c2
Kind: security · Impact: high

## In brief

- CVE-2026-124679 is an authentication bypass by spoofing in Apache APISIX, reported with a CVSS 4.0 base score of 7.8 (high).
- Per the advisory, on routes using jwe-decrypt or forward-auth, a client-supplied identity header may be passed upstream. Affected versions are 3.18.0 through 3.19.0.

## Why it matters

If you run Apache APISIX 3.18.0 through 3.19.0 with jwe-decrypt or forward-auth routes, a remote client may be able to impersonate another identity without authenticating.

## What to do

- Check whether any APISIX 3.18.0 through 3.19.0 deployment uses the jwe-decrypt or forward-auth plugins.

## Versions

- Apache APISIX 3.18.0 through 3.19.0

## CVEs

- CVE-2026-124679

## Timeline

- 2026-11-13: CVE-2026-124679 disclosed in Open Source Security advisory

## Coverage

- [CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header](https://seclists.org/oss-sec/2026/q4/692) — Open Source Security, 2026-11-13

Tags: security, apache-apisix, authentication, cve, api-gateway

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev