CVE-2026-39999

CVE-2026-39999 affects Apache APISIX (v2.2–v3.16.0) via the jwt-auth plugin. The issue enables an authentication bypass by spoofing due to a JWT algorithm confusion/configuration, allowing a network attacker with no privileges to bypass auth (NONE -> HIGH impact on confidentiality/integrity). ...