Executive Summary

CVE-2026-47341 is an Authentication Bypass vulnerability in Apache APISIX versions 3.11.0 through 3.16.0. It affects the hmac-auth plugin, where attackers can exploit certain configurations to reuse a token indefinitely, bypassing its expiration.

This means an attacker can perform a capture-replay attack to reuse a valid token forever, gaining unauthorized access to protected resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass authentication by reusing tokens indefinitely, which can lead to unauthorized access to protected resources.

Such unauthorized access can compromise the security of your systems, potentially exposing sensitive data or allowing malicious actions within your environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Authentication Bypass by Capture-replay vulnerability in Apache APISIX, users are strongly advised to upgrade their Apache APISIX installation to version 3.17.0 or later, where this issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to bypass authentication by reusing tokens indefinitely, which leads to unauthorized access to protected resources.

Such unauthorized access can potentially result in non-compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

However, the provided information does not explicitly discuss the impact on compliance with these standards.

Useful 0 Not Useful 0