Vendor

WSO2

131 known vulnerabilities.

Products

WSO2 API Manager 95 WSO2 Identity Server 88 WSO2 Identity Server as Key Manager 54 WSO2 API Control Plane 51 WSO2 Open Banking IAM 51 WSO2 Open Banking AM 45 WSO2 Universal Gateway 40 WSO2 Traffic Manager 40 WSO2 Enterprise Integrator 29 WSO2 Carbon OAuth 8 WSO2 Open Banking KM 8 WSO2 Micro Integrator 7 WSO2 Carbon API Management Implementation 6 WSO2 Carbon User Manager Kernel 5 WSO2 Carbon API Manager Rest API Utility 5 WSO2 Carbon Identity Application Authentication Framework 5 WSO2 Enterprise Mobility Manager 4 WSO2 Carbon Identity User Store Configuration UI 3 org.wso2.carbon:org.wso2.carbon.ui 3 WSO2 Enterprise Service Bus 3 org.wso2.carbon:org.wso2.carbon.base 3 WSO2 Carbon MagicLink Authenticator Module 3 WSO2 IS as Key Manager 3 Email OTP Authenticator 3 WSO2 Carbon Registry Resources UI 2 WSO2 Carbon Identity Management 2 WSO2 Carbon API Management API 2 WSO2 Carbon API Gateway 2 WSO2 Carbon API Manager Rest API Common Functions 2 WSO2 Carbon User Management UI 2 org.wso2.carbon:org.wso2.carbon.server.admin 2 WSO2 Carbon Identity Recovery Management 2 WSO2 API Manager Analytics 2 carbon-registry 2 WSO2 API Microgateway 2 WSO2 Identity Server Analytics 2 WSO2 Data Analytics Server 2 WSO2 Carbon Abstract OTP Authenticator 2 WSO2 Identity Server Keystore Rest API Commons 1 WSO2 Identity Server Keystore Rest API V1 1

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 10.0

CVE-2026-5430 Exploited Public exploit EPSS 22%

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager

Aug 6, 2026
KEV Sep 24, 2026