CVE-2022-29266: vulnerability in Apache APISIX
apisix/jwt-auth may leak secrets in error response
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 8.1%
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
Affected products
Apache Software Foundation · Apache APISIXRelated CVEs — Apache APISIX
In the same product, most dangerous first.
CVE-2022-24112CRITICALapisix/batch-requests plugin allows overwriting the X-REAL-IP headerEPSS 96.1%KEVCVE-2020-13945—CVE-2020-13945EPSS 73.6%CVE-2021-43557—Path traversal in request_uri variableEPSS 13.0%CVE-2022-25757—Apache APISIX: the body_schema check in request-validation plugin can be bypassedEPSS 2.5%CVE-2024-32638MEDIUMApache APISIX: Forward-Auth Request SmugglingEPSS 1.1%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.7%