CVE-2026-124719 is an authentication bypass vulnerability in Apache APISIX versions from 3.19.0 up to but not including 3.20.0. The flaw occurs when a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, allowing an attacker to spoof another identity against the upstream API. The issue is fixed in version 3.20.0.