by Kastro
Paper/Archive/CVE-2026-5430

CVE-2026-5430

WSO2 WSO2 Universal Gateway — Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

KEV · due 27 SepEPSS 22%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 97.7.977 × 2019.5Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Affected

ProductAffectedFixed inSource
WSO2 Universal Gateway4.5.0 – < 4.5.0.574.5.0.57CNA
WSO2 Universal Gateway4.6.0 – < 4.6.0.214.6.0.21CNA
WSO2 Traffic Manager4.5.0 – < 4.5.0.564.5.0.56CNA
WSO2 Traffic Manager4.6.0 – < 4.6.0.214.6.0.21CNA
WSO2 API Control Plane4.5.0 – < 4.5.0.584.5.0.58CNA
WSO2 API Control Plane4.6.0 – < 4.6.0.224.6.0.22CNA
WSO2 API Manager4.1.0 – < 4.1.0.2574.1.0.257CNA
WSO2 API Manager4.2.0 – < 4.2.0.1974.2.0.197CNA
WSO2 API Manager4.3.0 – < 4.3.0.1084.3.0.108CNA
WSO2 API Manager4.4.0 – < 4.4.0.724.4.0.72CNA
WSO2 API Manager4.5.0 – < 4.5.0.574.5.0.57CNA
WSO2 API Manager4.6.0 – < 4.6.0.214.6.0.21CNA

Scores by source

WSO2 (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430kevcisa.gov/known-exploited-vulnerabilities-catalog