Unrated severityNVD Advisory· Published Jun 19, 2026· Updated Jun 19, 2026
Apache APISIX: Session replay issue in hmac-auth
CVE-2026-47341
Description
Authentication Bypass by Capture-replay vulnerability in Apache APISIX.
Attacker can benefit from certain configurations in hmac-auth to re-use a token forever, bypassing expiry. This issue affects Apache APISIX: from 3.11.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Affected products
2Patches
Vulnerability mechanics
References
1- lists.apache.org/thread/ob6ng9x2hxtyfojs839hs1n0v18xxzf2mitrevendor-advisory
News mentions
1- Apache APISIX: 12 CVEs Disclosed Across Nine Auth Plugins, All Fixed in 3.17.0Vypr Intelligence · Jun 19, 2026