Apache APISIX forward‑auth plugin contains an improper input validation flaw that allows an attacker to inject arbitrary identity headers when the plugin is misconfigured, enabling the attacker to impersonate any user or service. This can lead to unauthorized access or privilege escalation within the API gateway, as the gateway will accept the forged headers and treat the request as coming from the spoofed identity. This vulnerability is categorized as CWE‑20 – Improper Input Validation.

The affected product is Apache Software Foundation Apache APISIX. Versions from 2.12.0 through 3.16.0 are impacted. An upgrade to version 3.17.0 or later resolves the issue.

The CVSS score of 5.8 indicates medium severity, reflecting the potential for identity spoofing. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attacker can exploit this flaw remotely by sending crafted HTTP requests to the APISIX gateway that trigger the forward‑auth plugin, assuming the plugin is enabled and header cleanup is disabled. Attackers need network access to the gateway and do not require privileged local access.