CVE-2026-39999CWE-290

Apache APISIX: JWT Algorithm Confusion allows authentication bypass

High · published June 19, 2026

CVSS v4.0
7.0
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

Authentication Bypass by Spoofing vulnerability in Apache APISIX.

The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin.

This issue affects Apache APISIX: from v2.2 through v3.16.0.

Users are recommended to upgrade to version v3.17.0, which fixes the issue.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00635 · 49.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-06-19T13:07Z
EPSS history
Timeline
  • 19 JUN 13:07Z
    Apache APISIX: JWT Algorithm Confusion allows authentication bypass
    cvelistv5