Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: false and a
forward_header distinct from the token header an unauthenticated
client can supply the value the upstream treats as gateway-decrypted
plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.
This issue affects Apache APISIX: from 3.18.0 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Bu kayıt NIST NVD kaynağından aktarılmıştır. Etkilenen sürümler, güncel değerlendirme ve üretici referansları için kaynak kaydı inceleyin.