Skip to content
OpenAdvisories
Critical · 10.0 Known exploited Public exploit CVE-2026-5430 EUVD-2026-53822GHSA-j7vh-5w8q-4m4x

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Published Aug 6, 2026 · Updated Sep 25, 2026 · Assigned by WSO2

Vendor: WSO2 Product: WSO2 API Control Plane Product: WSO2 API Manager Product: WSO2 Carbon API Manager Rest API Utility Product: WSO2 Traffic Manager Product: WSO2 Universal Gateway

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Affected products

VendorProductAffectedFixed
WSO2 WSO2 Universal Gateway 4.5.0 – < 4.5.0.57, 4.6.0 – < 4.6.0.21 4.5.0.57
WSO2 WSO2 Traffic Manager 4.5.0 – < 4.5.0.56, 4.6.0 – < 4.6.0.21 4.5.0.56
WSO2 WSO2 API Control Plane 4.5.0 – < 4.5.0.58, 4.6.0 – < 4.6.0.22 4.5.0.58
WSO2 WSO2 API Manager 4.1.0 – < 4.1.0.257, 4.2.0 – < 4.2.0.197, 4.3.0 – < 4.3.0.108, 4.4.0 – < 4.4.0.72, 4.5.0 – < 4.5.0.57, 4.6.0 – < 4.6.0.21 4.1.0.257
WSO2 WSO2 Carbon API Manager Rest API Utility 9.20.74 – < 9.20.74.401, 9.28.116 – < 9.28.116.417, 9.29.120 – < 9.29.120.236, 9.30.67 – < 9.30.67.167, 9.31.86 – < 9.31.86.158, 9.32.147 – < 9.32.147.59 9.20.74.401

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • abraxas/CVE-2026-5430 ★ 2 · Sep 25, 2026

    CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway

  • davidvrns/CVE-2026-5430-WSO2 ★ 1 · Oct 8, 2026

    Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authori…

  • getdrive/wso2_cve-2026-5430_lab ★ 0 · Oct 8, 2026

    Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)

  • HORKimhab/CVE-2026-5430 ★ 0 · Sep 16, 2026

    CVE-2026-5430 - Draft or TODO

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References