CVE-2026-124716 Apache APISIX: authz-keycloak authorization scope mismatch

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124716

Apache APISIX versions 1.4.0 through 3.19.0 are impacted by an Incorrect Authorization vulnerability. An authenticated user possessing only one of the required permissions or scopes for a route can successfully access the protected upstream. This allows the user to bypass remaining security requi...

PT-2026-27024

Summary In specific LINE configurations, sender IDs approved through DM pairing could also satisfy group allowlist checks when operators expected group sender access to be scoped only to explicit group allowlists. Affected Packages / Versions - Package: openclaw npm - Latest published version at...