Apache APISIX’s jwe-decrypt plugin fails to validate the integrity check value properly, allowing an attacker to craft a JWE that is accepted without proper authentication. This flaw effectively bypasses authentication, enabling the attacker to impersonate any user or call protected APIs without authorization, thereby compromising confidentiality and integrity of protected resources.

Apache Software Foundation’s Apache APISIX product, versions 3.8.0 through 3.16.0, is affected. The vulnerability resides in the default configuration of the jwe-decrypt plugin.

The CVSS score of 6.3 indicates a medium severity issue. EPSS information is not available, and the vulnerability is not listed in CISA KEV, suggesting no known wide‑scale exploitation yet. The likely attack vector is an adversary sending a malicious JWE payload through the APISIX gateway, exploiting the plugin’s weak integrity check to gain unauthorized access to protected services.