CVE-2026-47341: Apache APISIX Authentication Bypass via Token Replay

Technical summary

CVE-2026-47341 is an authentication bypass vulnerability stemming from improper capture-replay protection in Apache APISIX's hmac-auth authentication module. The vulnerability arises from a configuration weakness that fails to adequately validate token freshness or implement replay detection. An attacker who obtains a valid HMAC-authenticated token can reuse it indefinitely despite configured expiry times. The flaw affects APISIX versions 3.11.0 through 3.16.0 and is resolved in version 3.17.0. The underlying weakness is classified as CWE-294 (Authentication Using a Known Password), indicating reliance on credential reuse without sufficient anti-replay measures.

Business impact

This vulnerability poses a moderate but persistent risk to API security posture. Organizations using APISIX with hmac-auth face the risk of token-based credential theft leading to sustained unauthorized API access. Unlike vulnerabilities requiring continuous exploitation, a single compromised token enables indefinite abuse, making this particularly dangerous in scenarios where tokens are exposed through logs, network captures, or insider access. The impact is limited to confidentiality and integrity of API-protected resources; availability is not directly threatened. For platforms relying on hmac-auth for rate limiting, usage tracking, or access control, token replay can degrade enforcement of these controls.

Affected systems

Apache APISIX deployments running version 3.11.0 through 3.16.0 are affected. The vulnerability manifests only when the hmac-auth plugin is active and configured in a manner that does not supplement token validation with anti-replay measures. Organizations using APISIX for API gateway functions—particularly those managing multi-tenant or sensitive API ecosystems—should prioritize inventory of deployed versions. Versions prior to 3.11.0 and version 3.17.0 and later are not affected.

Exploitability

Exploitability is straightforward once a valid token is obtained. The attack requires network access to the APISIX instance (CVSS AV:N) and no user interaction (UI:N). No special privileges are required on the attacker's end (PR:N). The attack complexity is low (AC:L), meaning standard tools and techniques suffice to perform token capture and replay. An attacker may obtain tokens through network interception, accidental exposure in logs, or social engineering. The primary barrier to exploitation is token acquisition, not the replay mechanism itself.

Remediation

Upgrade Apache APISIX to version 3.17.0 or later, which implements proper anti-replay protections in the hmac-auth module. Organizations unable to patch immediately should consider interim measures: restrict token lifetime to the shortest operationally feasible duration, monitor for suspicious token reuse patterns (multiple requests with identical timestamps or from unusual sources), and implement additional authentication layers (IP allowlisting, mutual TLS) if the architecture permits. Review hmac-auth plugin configurations to ensure they do not disable or weaken expiry validation.

Patch guidance

Upgrade to Apache APISIX version 3.17.0 or later. The patch addresses the root cause of the capture-replay vulnerability by strengthening token validation logic and enforcing replay detection. Before upgrading, verify compatibility with your installed plugins and test in a non-production environment, as major version updates may introduce configuration changes. Consult the Apache APISIX release notes for version 3.17.0 to confirm the fix and any breaking changes. Coordinate the upgrade during a maintenance window to minimize API availability risk.

Detection guidance

Monitor for indicators of token replay: (1) Identical HMAC-Auth tokens appearing in API requests from different source IPs or within an unusually short timeframe; (2) Repeated successful authentication using the same token value after its expected expiry window; (3) Requests with inconsistent user agents, geographic origins, or request patterns bearing the same authentication credentials; (4) Anomalous spikes in API usage by a single authenticated user or token. Implement centralized logging of authentication events with token hashing for privacy, and correlate logs across your APISIX fleet to detect distributed replay attempts. API gateway access logs and APISIX debug logs should be retained for post-incident analysis.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability merits prompt attention because token replay is persistent—a single compromised token enables ongoing unauthorized access without further attacker action. Unlike transient vulnerabilities requiring repeated exploitation, this flaw can remain exploited indefinitely if unpatched. The ease of exploitation (low complexity, no authentication required) and the ubiquity of API gateways in modern architectures compound the risk. For organizations handling sensitive API workloads, elevation to high priority is justified despite the numerical score.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects the vulnerability's network-accessible attack vector, low complexity, and lack of required privileges or user interaction. However, the impact is limited to partial confidentiality and integrity loss (C:L, I:L) with no availability impact (A:N). This places it in the moderate range. The score does not fully capture the persistence of the threat once exploitation occurs; a single token theft can result in sustained abuse. Organizations should apply context-specific risk assessment: high sensitivity APIs or data warrant elevation above the baseline score, while lower-risk APIs may accept delayed patching if mitigations are in place.

Frequently asked questions