Apache APISIX versions 3.18.0 through 3.19.0 contain an authentication bypass vulnerability due to spoofing. This occurs on routes using jwe-decrypt with strict mode disabled and a forward_header different from the token header, allowing unauthenticated clients to supply values treated as decrypted plaintext by the upstream. A similar issue arises when forward-auth is configured with allow_degradation set to true and the authentication service is unavailable. The vulnerability is fixed in version 3.20.0.