Vulnerability · Published Jun 19, 2026 · Assigned by apache

CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypass

High 7.0

In plain English

A high-severity authentication bypass by spoofing in Apache APISIX from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.6%top 49.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0. Users are recommended to upgrade to version v3.17.0, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX	2.2 – through 3.16.0

Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

In plain English

Official description

Affected products (as reported)

References