{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "HTTP GET / on APISIX gateway (port 9080) with Authorization: Bearer <forged HS256 JWT>; one route protected by jwt-auth with three consumers (RS256, ES256, EdDSA) selectable via the token key claim",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "end_to_end_bypass_on_fixed": false,
  "runtime_stack": [
    "apache/apisix:3.16.0-debian (vulnerable) -> sha256:b921bdef3cfb2ca72e483d643f40e7843683ff8e188984489c2020f17654ee88",
    "apache/apisix:3.17.0-debian (fixed) -> sha256:6cbf65f3085d1386bfd636b7e88400c163c3641841909e674af7896a5766b092",
    "bitnamilegacy/etcd:3.6",
    "python:3-slim (upstream http.server + client helper)"
  ],
  "tested_versions": {
    "vulnerable": {"image": "apache/apisix:3.16.0-debian", "apisix_version": "3.16.0", "release_tag_commit": "f9c4ee37170bdfe075c846973c1be65a582a0c4f", "fix_present": false},
    "fixed": {"image": "apache/apisix:3.17.0-debian", "apisix_version": "3.17.0", "release_tag_commit": "9ef2ecab67f652d38365049613610ef649bb4ad0", "fix_present": true}
  },
  "results": {
    "vulnerable_3_16_0": {
      "no_jwt": 401,
      "RS256_forged_hs256": {"code": 200, "bypass": true},
      "ES256_forged_hs256": {"code": 200, "bypass": true},
      "EdDSA_forged_hs256": {"code": 200, "bypass": true}
    },
    "fixed_3_17_0": {
      "no_jwt": 401,
      "RS256_forged_hs256": {"code": 401, "bypass": false, "log": "algorithm mismatch, expected RS256"},
      "ES256_forged_hs256": {"code": 401, "bypass": false, "log": "algorithm mismatch, expected ES256"},
      "EdDSA_forged_hs256": {"code": 401, "bypass": false, "log": "algorithm mismatch, expected EdDSA"}
    }
  },
  "proof_artifacts": [
    "logs/variant_harness_vulnerable.log",
    "logs/variant_harness_fixed.log",
    "logs/variant_apisix_vulnerable.log",
    "logs/variant_apisix_fixed.log",
    "vuln_variant/artifacts/variant_results_vulnerable.json",
    "vuln_variant/artifacts/variant_results_fixed.json",
    "vuln_variant/artifacts/rsa_public.pem",
    "vuln_variant/artifacts/ec_public.pem",
    "vuln_variant/artifacts/ed_public.pem",
    "vuln_variant/artifacts/variant_harness.py",
    "vuln_variant/artifacts/apisix_config.yaml",
    "logs/variant_run1.stdout.log",
    "logs/variant_run2.stdout.log"
  ],
  "notes": "Alternate triggers (ES256 ECDSA, EdDSA Ed25519) reproduce the authz_bypass on vulnerable 3.16.0 (HTTP 200, request proxied to upstream) using the same forged-HS256-with-public-key-as-HMAC-secret technique as the original RS256 CVE. On fixed 3.17.0 all three are rejected (HTTP 401) with 'algorithm mismatch, expected <alg>' logged at jwt-auth.lua:338. Script exits 1 (no bypass). Idempotent across two consecutive runs."
}