CVE-2026-49230 — Apache APISIX: Authentication bypass in jwe-decrypt

CVE-2026-49230

Apache APISIX: Authentication bypass in jwe-decrypt PUBLISHED

Description (CNA)

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache APISIX	affected 3.8.0 through 3.16.0

CWE

CWE-354

References

https://lists.apache.org/thread/n0blgkpvz38ghh5rrh6wtl476919xj1b

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/19/12

CISA-ADP

No English description supplied.

No references supplied.