CVE-2026-39999 -- CVSS 9.1 Vulnerability Briefing
CVE-2026-39999 | CVSS 9.1 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-39999 is a critical authentication bypass vulnerability in Apache APISIX, specifically affecting the jwt-auth plugin, which allows an unauthenticated attacker to completely circumvent authentication controls under certain plugin configurations.
Technical Detail
The flaw is an authentication bypass by spoofing condition within the jwt-auth plugin of Apache APISIX, where specific plugin configurations fail to properly validate or enforce JWT-based authentication, enabling an attacker to craft or manipulate requests that are accepted as authenticated without presenting valid credentials. The precise triggering condition depends on how the jwt-auth plugin is configured on the target gateway, meaning deployments using non-default or certain combined configurations are at elevated risk. Successful exploitation grants an attacker full authentication bypass, potentially exposing all upstream services and APIs protected by the affected APISIX gateway to unauthorized access.
Exploitation Status
No known exploit code has been publicly identified at this time, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of June 26, 2026. The exploit maturity is assessed as none, meaning no public proof-of-concept or operational exploit has been confirmed. However, the high CVSS score of 9.1 and the straightforward nature of authentication bypass vulnerabilities mean the barrier to independent exploitation may be low for a capable attacker once the configuration conditions are understood.
Who Is Targeting This
No confirmed threat actor attribution has been established for this vulnerability. Reported attribution, inferred from research sources at medium confidence, includes COPYKITTENS, EVILNUM, LOTUSBLOSSOM, SEATURTLE, and WINDSHIFT. No origin country or specific motivation has been associated with any of these actors in the context of this CVE. These attributions should be treated as unverified and research-inferred only; they do not represent confirmed operational targeting of this vulnerability by any named group.
What To Do
Organizations running Apache APISIX with the jwt-auth plugin enabled should treat this as a high-priority patch given the critical severity rating and the potential for complete authentication bypass. Apply the vendor-supplied patch for Apache APISIX as soon as it becomes available and verify the patched version through the official Apache APISIX security advisories. As an interim measure, review and audit all jwt-auth plugin configurations to identify and remediate any non-standard or combined configurations that may expose the bypass condition, and consider temporarily restricting access to affected API routes at the network perimeter. Monitor gateway access logs for anomalous authentication patterns, including requests that successfully reach upstream services without valid JWT tokens, as a detection signal for potential exploitation attempts.