CVE-2026-39999

CriticalCVSS 9.1/10Last modified Oct 25, 2026

Description

Authentication Bypass by Spoofing vulnerability in Apache APISIX.

The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0.

Users are recommended to upgrade to version v3.17.0, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX	>= 2.2, <= 3.16.0

References

https://lists.apache.org/thread/nfopt8cnxd3k0rs1oxtr7lzxrdw4mojqVendor Advisory, Mailing List
http://www.openwall.com/lists/oss-security/2026/06/19/5Third Party Advisory

Timeline

Published: Jun 19, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-400001.8The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-pa CVE-2026-400015.2There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arb CVE-2026-400028.8Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations. The vulnerabilit CVE-2026-400036.8ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target addres CVE-2026-400047.8There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code loc CVE-2026-400059.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrar CVE-2026-400067.5Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Funct CVE-2026-400077.5Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB CVE-2026-400089.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a CVE-2026-400096.5Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path acc CVE-2026-40019.8The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, CVE-2026-400109.1Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack i