Which versions of Apache APISIX are affected by CVE-2026-39999?

Apache APISIX versions 2.2 through 3.16.0 contain an authentication bypass vulnerability in the jwt-auth plugin that allows attackers to access APIs designed to require JWT authentication, creating a…

How to fix or mitigate CVE-2026-39999?

Within 24 hours: Audit all APISIX deployments to identify affected versions (2.2-3.16.0) and confirm jwt-auth plugin status; enable detailed access logging on protected API endpoints to establish baseline and detect anomalies. Within 7 days: Implement additional authentication enforcement through a reverse proxy, Web Application Firewall, or OAuth 2.0 gateway positioned in front of APISIX; restrict network access to the API gateway from trusted client networks only. Within 30 days: Monitor Apache Software Foundation security advisories for patch release; develop and test upgrade plan to patched version once available; evaluate alternative API gateway solutions if patch timeline becomes unacceptable.

Apache APISIX CVE-2026-39999

Q: What is the CVSS score of CVE-2026-39999?

CVE-2026-39999 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38013 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-06-19 apache

GHSA-pw26-hvcp-w6vj

Authentication Bypass Apache Apache Apisix Apache Software Foundation

7.0

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network-reachable bypass requiring a specific jwt-auth config (AC:H) with no auth or interaction; scope changes to backend (S:C) yielding high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:17 vuln.today

CVE Published

Jun 19, 2026 - 13:07 cve.org

HIGH 7.0

DescriptionCVE.org

Authentication Bypass by Spoofing vulnerability in Apache APISIX.

The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0.

Users are recommended to upgrade to version v3.17.0, which fixes the issue.

AnalysisAI

Authentication bypass in Apache APISIX versions 2.2 through 3.16.0 allows remote attackers to circumvent authentication enforced by the jwt-auth plugin under certain configurations, granting unauthorized access to APIs that should require a valid JWT. The flaw stems from spoofable identity assertions (CWE-290) in the plugin's verification logic, and at time of analysis there is no public exploit identified, but the wide affected version range and gateway role make it operationally significant.

Technical ContextAI

Apache APISIX is a cloud-native, dynamic API gateway built on OpenResty/Nginx and Lua that brokers traffic to upstream services and enforces cross-cutting concerns such as authentication, rate limiting, and observability via a pluggable architecture. The jwt-auth plugin is responsible for validating JSON Web Tokens presented by clients before requests are proxied; per CWE-290 (Authentication Bypass by Spoofing), the issue likely arises from the plugin trusting attacker-controllable token claims or header fields rather than cryptographically binding the request to a verified consumer, which can occur when certain configuration options (for example permissive algorithm handling or consumer-claim mapping) are enabled. The CPE cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:* covers all APISIX builds, but the description narrows real exposure to deployments that actually use jwt-auth with the vulnerable configuration shape.

RemediationAI

Vendor-released patch: Apache APISIX v3.17.0 - upgrade all gateway instances per the Apache advisory at https://lists.apache.org/thread/nfopt8cnxd3k0rs1oxtr7lzxrdw4mojq. Until upgrade is possible, audit every route that references the jwt-auth plugin and compare its configuration against the patched defaults: explicitly pin the expected signing algorithm (avoid permitting 'none' or asymmetric/symmetric algorithm confusion), require a fixed key/secret per consumer rather than client-controllable kid lookups, and remove any custom claim-to-consumer mapping that trusts request-supplied identifiers; the trade-off is that tightening these settings may break clients that relied on the lax behavior and will require coordinated rotation. As a compensating control, place an upstream WAF or mTLS check in front of jwt-auth-protected routes so that authentication does not solely depend on the vulnerable plugin, accepting the added latency and operational complexity.