The forward‑auth plugin of Apache APISIX contains a header injection flaw. By altering the plugin’s configuration, an attacker can insert arbitrary HTTP headers into requests forwarded to downstream services. This can allow alteration of request handling, bypass of authentication controls, or modification of responses, thereby potentially compromising the integrity and confidentiality of exchanges.

Affected versions of Apache APISIX range from 2.12.0 through 3.15.0. The vulnerability is present in the forward‑auth plugin bundled with these releases, so any deployment utilizing that plugin for authentication forwarding is at risk.

This CVE has a CVSS score of 9.1 and an EPSS score of less than 1%. It is not listed in the KEV catalog, so no publicly known exploits have been documented. The likely attack vector is remote via HTTP traffic to the gateway, as the flaw is triggered by requests that reach the forward‑auth plugin. Given the high severity score, the risk is considered high until an update is applied.