What is GHSA-qw6r-gcj7-4546?

GHSA-qw6r-gcj7-4546 is a security advisory published by GitHub Security Advisories with Low severity. Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured...

Which CVE IDs does GHSA-qw6r-gcj7-4546 cover?

GHSA-qw6r-gcj7-4546 covers the following CVE IDs: CVE-2026-124719. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-qw6r-gcj7-4546Low

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-124719 →

📋 Description

Authentication bypass by spoofing vulnerability in Apache APISIX.

When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-124719
https://lists.apache.org/thread/k7v3vfh09mr1spk4r5k8n1gsjrhk6d8x
http://www.openwall.com/lists/oss-security/2026/11/13/9
https://github.com/advisories/GHSA-qw6r-gcj7-4546