jwt-auth Plugin Unauthorized Access

The vulnerability of the jwt-auth plugin for the Apache APISIX cloud API gateway involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain unauthorized access to protected information...

EUVD-2026-38015

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...