Riskcovery

CVE-2026-14916

Kong API Gateway Enterprise: JWT Algorithm-Confusion

State
Published
Severity
7.7 High
Published
Sep 16, 2026
Updated
Sep 16, 2026
Reserved
Jul 7, 2026

Read the record on cve.org

Description

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification.

As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.

Scores

CVSSScoreVectorSource
4.07.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NKong

Weaknesses

  • CWE-241 Improper handling of unexpected data type

Affected Products

ProductVersions
Kong Enteprise GatewayKong
  • 3.15.0.0 to before 3.15.0.3Affected
  • 3.14.0.0 to before 3.14.0.12Affected
  • 3.13.0.0 to before 3.13.0.9Affected
  • 3.12.0.0 to before 3.12.0.10Affected
  • 3.10.0.0 to before 3.10.0.17Affected
  • 3.4.0.0 to before 3.4.3.29Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.