CVE-2026-39999 is a critical authentication bypass by spoofing (CVSS 9.1) in Apache APISIX. Under certain jwt-auth plugin configurations, an attacker can bypass authentication completely. It affects v2.2 through v3.16.0, and Apache recommends upgrading to v3.17.0, which fixes the issue for all affected versions.
What's affected
Apache APISIX from v2.2 through v3.16.0 is affected. The fixed version is v3.17.0.
The record says the bypass depends on certain configurations of the jwt-auth plugin, without describing which ones. Read the Apache announcement for the details.
How to check if you're exposed
apisix version
docker ps --format '{{.Image}}' | grep -i apisix
Then list routes and consumers that use the jwt-auth plugin, since those are the ones in scope.
What to do now
- Upgrade to v3.17.0 or later.
- Inventory routes that use jwt-auth and read the Apache announcement for risky configurations.
- Add an upstream check so backends do not rely on the gateway alone for authorization.
- Review access logs on jwt-auth routes for unauthenticated successes.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-290 (Authentication Bypass by Spoofing). A gateway that accepts a token as proof of identity must verify it against the right key and claims. Here, certain configurations let a spoofed identity pass.
Gateways concentrate trust, so one bypass can expose every service behind a route. The record does not flag this CVE as exploited in the wild.
Quick check
Which versions are affected?
v2.2 through v3.16.0.
Is every jwt-auth setup affected?
The record says certain configurations. Check the Apache announcement.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
