# CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/693) · 2026-11-13 · Security
Page: https://themorning.dev/story/cve-2026-124680-apache-apisix-route-level-authentication-bypass-via-path-normali-40ff40c59a6e6be2
Kind: security · Impact: high

## In brief

- CVE-2026-124680 is a route-level authentication bypass in Apache APISIX caused by a path normalization mismatch between routing and upstream forwarding.
- The flaw is an interpretation conflict that results in an incorrect authorization vulnerability.
- Affected versions are Apache APISIX 0.9 through 3.19.0, with a CVSS 4.0 base score of 7.0 (high).

## Why it matters

Authentication rules configured on APISIX routes can be bypassed by requests whose paths are normalized differently by the router and the upstream, so protected upstream services may be reachable without credentials.

## Versions

- Apache APISIX 0.9 through 3.19.0

## CVEs

- CVE-2026-124680

## Timeline

- 2026-11-13: Vulnerability disclosed on Open Source Security

## Coverage

- [CVE-2026-124680: Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding](https://seclists.org/oss-sec/2026/q4/693) — Open Source Security, 2026-11-13

Tags: apache-apisix, authentication, security, vulnerability, api-gateway

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev