CVE-2026-5430

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

State: Published
Severity: 10.0 Critical
Published: Aug 6, 2026
Updated: Sep 25, 2026
Reserved: Apr 2, 2026

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	WSO2

Weaknesses

CWE-347 Improper Validation of Certificate With Host Mismatch

Affected Products

Product	Versions
WSO2 Universal GatewayWSO2	4.5.0 to before 4.5.0.57Affected 4.6.0 to before 4.6.0.21Affected
WSO2 Traffic ManagerWSO2	4.5.0 to before 4.5.0.56Affected 4.6.0 to before 4.6.0.21Affected
WSO2 API Control PlaneWSO2	4.5.0 to before 4.5.0.58Affected 4.6.0 to before 4.6.0.22Affected
WSO2 API ManagerWSO2	before 4.1.0Unknown 4.1.0 to before 4.1.0.257Affected 4.2.0 to before 4.2.0.197Affected 4.3.0 to before 4.3.0.108Affected 4.4.0 to before 4.4.0.72Affected 4.5.0 to before 4.5.0.57Affected 4.6.0 to before 4.6.0.21Affected
WSO2 Carbon API Manager Rest API UtilityWSO2	9.20.74 to before 9.20.74.401Affected 9.28.116 to before 9.28.116.417Affected 9.29.120 to before 9.29.120.236Affected 9.30.67 to before 9.30.67.167Affected 9.31.86 to before 9.31.86.158Affected 9.32.147 to before 9.32.147.59Affected 9.33.106 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.