Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-39999 is a vulnerability classified as Authentication Bypass by Spoofing, affecting Apache APISIX (affected versions: 2.2 – ≤ 3.16.0). This vulnerability is rated High, with a CVSS score of 7. Current sources do not report this vulnerability as exploited.
The analysis could not be completed. The original vulnerability data remains available below.
Authentication Bypass by Spoofing vulnerability in Apache APISIX.
The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 through v3.16.0.
Users are recommended to upgrade to version v3.17.0, which fixes the issue.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
