Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.
CWE-290