EUVD-2026-38019
GHSA-3mg6-56vq-7899
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges; scope changed because bypass grants unauthorized access to protected backend services with low C/I impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Improper Validation of Integrity Check Value vulnerability in Apache APISIX.
The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
AnalysisAI
Authentication bypass in Apache APISIX's jwe-decrypt plugin (versions 3.8.0 through 3.16.0) allows unauthenticated network attackers to circumvent JWE token integrity validation and reach services protected by the gateway. The root cause (CWE-354) is improper validation of the JWE authentication tag under the plugin's default configuration, meaning crafted or tampered tokens are accepted as legitimate. No public exploit code and no CISA KEV listing are identified at time of analysis; the vendor-released fix is Apache APISIX 3.17.0.
Technical ContextAI
Apache APISIX is a high-performance API gateway built on OpenResty/nginx, and its jwe-decrypt plugin provides gateway-layer decryption and authentication enforcement of JSON Web Encryption (JWE) tokens per RFC 7516. CWE-354 (Improper Validation of Integrity Check Value) indicates the plugin fails to properly verify the JWE authentication tag - the integrity MAC that ensures the encrypted payload has not been tampered with - before accepting and forwarding the request. By skipping or incorrectly performing this check, a forged or modified JWE token with an invalid authentication tag is treated as valid. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix covering the 3.8.0 through 3.16.0 release range. The CVSS 4.0 vector's scope structure (VC:N/VI:N/VA:N with SC:L/SI:L) confirms that APISIX itself is not directly harmed; rather, the vulnerability's impact propagates to the backend services the gateway is protecting.
RemediationAI
Vendor-released patch: Apache APISIX 3.17.0. Upgrade immediately by following the standard APISIX release upgrade procedure documented in the project's official upgrade guide. The advisory is at https://lists.apache.org/thread/n0blgkpvz38ghh5rrh6wtl476919xj1b. If an immediate upgrade is not feasible, disable the jwe-decrypt plugin across all routes and services and substitute an alternative APISIX authentication plugin such as jwt-auth or key-auth as a temporary compensating control; note this requires reconfiguring upstream clients to present tokens in the format expected by the replacement plugin, which may introduce operational disruption. Additionally, apply network-layer IP allowlists on routes currently protected by the jwe-decrypt plugin to restrict access to trusted client CIDRs until patching is complete, acknowledging that this reduces but does not eliminate risk if trusted IPs can be spoofed or compromised.
More in Apache Apisix
View allHeader injection in Apache APISIX 2.12.0 through 3.15.0 lets remote attackers smuggle attacker-controlled HTTP headers t
Sensitive authentication tokens in Apache APISIX OpenID Connect plugin transmit in cleartext when connecting to identity
Authentication bypass in Apache APISIX versions 2.2 through 3.16.0 allows remote attackers to circumvent authentication
HMAC authentication replay in Apache APISIX 3.11.0 through 3.16.0 permits remote attackers who have captured a valid hma
Identity header spoofing in Apache APISIX versions 2.12.0 through 3.16.0 allows a low-privileged network attacker to man
Authentication bypass in Apache APISIX 3.0.0 through 3.16.0 allows a network-accessible attacker holding valid credentia
Incorrect authorization in the Apache APISIX authz-casdoor plugin allows a network-authenticated attacker to cross-authe
Identity header spoofing in Apache APISIX's openid-connect plugin (versions 2.3 through 3.16.0) enables low-privileged n
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent C
Identity header spoofing in the Apache APISIX OPA (Open Policy Agent) plugin allows low-privileged network attackers to
The wolf-rbac plugin in Apache APISIX 1.2.0 through 3.16.0 trusts client-controlled identity and IP data under its defau
Open redirect in Apache APISIX 3.0.0 through 3.16.0 enables unauthenticated remote attackers to manipulate specific HTTP
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today