CVE-2026-5430
published 2026-08-06CVE-2026-5430: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a…
PriorityP187critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-27
Exploited in the wild
EPSS
0.59%
47.4th percentile
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wso2 | api_control_plane | >= 4.5.0 < 4.5.0.58 | 4.5.0.58 |
| wso2 | api_control_plane | >= 4.6.0 < 4.6.0.22 | 4.6.0.22 |
| wso2 | api_manager | >= 4.1.0 < 4.1.0.257 | 4.1.0.257 |
| wso2 | api_manager | >= 4.2.0 < 4.2.0.197 | 4.2.0.197 |
| wso2 | api_manager | >= 4.3.0 < 4.3.0.108 | 4.3.0.108 |
| wso2 | api_manager | >= 4.4.0 < 4.4.0.72 | 4.4.0.72 |
| wso2 | api_manager | >= 4.5.0 < 4.5.0.57 | 4.5.0.57 |
| wso2 | api_manager | >= 4.6.0 < 4.6.0.21 | 4.6.0.21 |
| wso2 | traffic_manager | >= 4.5.0 < 4.5.0.56 | 4.5.0.56 |
| wso2 | traffic_manager | >= 4.6.0 < 4.6.0.21 | 4.6.0.21 |
| wso2 | universal_gateway | >= 4.5.0 < 4.5.0.57 | 4.5.0.57 |
| wso2 | universal_gateway | >= 4.6.0 < 4.6.0.21 | 4.6.0.21 |
| wso2 | wso2_api_control_plane | >= 4.5.0 < 4.5.0.58 | 4.5.0.58 |
| wso2 | wso2_api_control_plane | >= 4.6.0 < 4.6.0.22 | 4.6.0.22 |
| wso2 | wso2_api_manager | >= 4.1.0 < 4.1.0.257 | 4.1.0.257 |
| wso2 | wso2_api_manager | >= 4.2.0 < 4.2.0.197 | 4.2.0.197 |
| wso2 | wso2_api_manager | >= 4.3.0 < 4.3.0.108 | 4.3.0.108 |
| wso2 | wso2_api_manager | >= 4.4.0 < 4.4.0.72 | 4.4.0.72 |
| wso2 | wso2_api_manager | >= 4.5.0 < 4.5.0.57 | 4.5.0.57 |
| wso2 | wso2_api_manager | >= 4.6.0 < 4.6.0.21 | 4.6.0.21 |
| wso2 | wso2_carbon_api_manager_rest_api_utility | >= 9.20.74 < 9.20.74.401 | 9.20.74.401 |
| wso2 | wso2_carbon_api_manager_rest_api_utility | >= 9.28.116 < 9.28.116.417 | 9.28.116.417 |
| wso2 | wso2_carbon_api_manager_rest_api_utility | >= 9.29.120 < 9.29.120.236 | 9.29.120.236 |
| wso2 | wso2_carbon_api_manager_rest_api_utility | >= 9.30.67 < 9.30.67.167 | 9.30.67.167 |
| wso2 | wso2_carbon_api_manager_rest_api_utility | >= 9.31.86 < 9.31.86.158 | 9.31.86.158 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.
ghsa_unreviewed·2026-08-06
CVE-2026-5430 [CRITICAL] CWE-347 The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
VulDB
WSO2 API Control Plane improper authorization (WID-SEC-2026-2085)
vuldb·2026-08-06·CVSS 10.0
CVE-2026-5430 [CRITICAL] WSO2 API Control Plane improper authorization (WID-SEC-2026-2085)
A vulnerability was found in WSO2 API Control Plane, API Manager, Carbon API Manager Rest API Utility, Traffic Manager and Universal Gateway. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization.
This vulnerability is traded as CVE-2026-5430. It is possible to initiate the attack remotely. There is no exploit available.
VulnCheck
WSO2 api_control_plane Improper Verification of Cryptographic Signature
vulncheck·2026·CVSS 10.0
CVE-2026-5430 [CRITICAL] WSO2 api_control_plane Improper Verification of Cryptographic Signature
WSO2 api_control_plane Improper Verification of Cryptographic Signature
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Affected: WSO2 api_control_plane
Required Action: Apply remediations or mitigatio
CISA
WSO2 Multiple Products Path Traversal Vulnerability
cisa·2026-09-24·CVSS 10.0
CVE-2026-5430 [CRITICAL] CWE-347 WSO2 Multiple Products Path Traversal Vulnerability
Vulnerability: WSO2 Multiple Products Path Traversal Vulnerability
Affected: WSO2 Multiple Products
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
No detection rules found.
No public exploits indexed.
Hackernews
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
blogs_hackernews·2026-09-25·CVSS 10.0
CVE-2026-5430 [CRITICAL] WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities ( KEV ) catalog, based on evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution.
CVE-2026-71362 (CVSS score: 9.1) - An incorre
Hackernews
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
blogs_hackernews·2026-09-16·CVSS 10.0
CVE-2026-5430 [CRITICAL] Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.
The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.
"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access," according to an advisory released by WSO2 in
2026-08-06
Published
2026-09-24
Added to CISA KEV
Exploited in the wild