International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 43 · Tier B

CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

oss-security ·

The Brief

  • CVE-2026-124680 is a route-level authentication bypass in Apache APISIX caused by a path normalization mismatch between routing and upstream forwarding.
  • The flaw is an interpretation conflict that results in an incorrect authorization vulnerability.
  • Affected versions are Apache APISIX 0.9 through 3.19.0, with a CVSS 4.0 base score of 7.0 (high).

Why it matters

Authentication rules configured on APISIX routes can be bypassed by requests whose paths are normalized differently by the router and the upstream, so protected upstream services may be reachable without credentials.

Who’s affected

  • Teams running Apache APISIX versions 0.9 through 3.19.0
  • Teams relying on route-level authentication in Apache APISIX

Posted by Abhishek Choudhary on Nov 13 Severity: CVSS 4.0: 7.0 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N Affected versions: - Apache APISIX 0.9 through 3.19.0 Description: Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability…

Read the full story at seclists.org ↗

Timeline

  1. Vulnerability disclosed on Open Source Security

  2. Open Source Security

    CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

How do you feel about this?

0 Comments

    CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding – The Morning Dev