CVE-2026-39999: Apache APISIX jwt-auth authentication bypass via algorithm confusion
CVE-2026-39999 is verified against apache/apisix · github affected versions: 2.2.0 through 3.16.0 fixed version: 3.17.0 vulnerability class: Auth Bypass This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00287.
pruva-verify REPRO-2026-00287 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00287/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Apache APISIX jwt-auth trusted the JWT header alg value to choose the signature verification primitive, while separately selecting the verification key from trusted consumer configuration. Under RS256-style consumer configs, an attacker could swap the token header to HS256 and use the consumer’s public key as an HMAC secret, resulting in an authentication bypass. Affected versions: 2.2.0 through 3.16.0. Fixed in 3.17.0.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.