tag
Api-Gateway
Apache APISIX `jwe-decrypt` Integrity-Check Bypass → Unauthenticated Gateway Auth Bypass (CVE-2026-49230)
The jwe-decrypt plugin is an auth-type APISIX plugin that decrypts an incoming JWE token with a per-consumer AES-256-GCM secret and forwards the plaintext upstream as proof of authentication. Its internal helper jwedecryptwithobj() returns only the decrypted…
Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908
Apache APISIX's forward-auth plugin fails to sanitize CRLF (\r\n) sequences in inbound request headers before forwarding an authentication check upstream. By injecting CRLF sequences into headers such as Authorization, X-Forwarded-For, or Host, an…
Floci API Gateway VTL RCE + IAM Scope Bypass
Floci evaluates user-controlled API Gateway integration response templates with an unrestricted Apache Velocity engine that exposes $util, allowing template code to reach java.lang.ProcessBuilder via reflection and execute arbitrary OS commands in the Floci…