Do Son APISIX authentication bypass CVE-2026-39999 lets attackers forge JWTs via algorithm confusion. APISIX 3.16.0 is affected; upgrade to 3.16.1.
Algorithm Confusion
CVE-2026-34950: A critical 9.1 CVSS flaw in fast-jwt allows authentication bypass via leading whitespace. Learn how a regex error leads to algorithm confusion.
Parse Server patches a critical 9.1 CVSS vulnerability (CVE-2026-27804). Attackers can forge Google tokens using "alg: none" to hijack any linked user account.