TL;DR Apache APISIX 3.16.0 shipped a JWT algorithm confusion bug in its jwt-auth plugin. The flaw, tracked as The post Apache APISIX JWT Authentication Bypass, CVE-2026-39999 appeared first on Daily CyberSecurity.