Apache APISIX versions 3.8.0 through 3.19.0 are affected by an authentication bypass vulnerability due to spoofing. This occurs when multi-authentication falls back from wolf-rbac to another authenticator, allowing client-supplied Wolf identity headers to persist and potentially mislead downstream services about the authenticated identity. The issue is fixed in version 3.20.0.