CVE-2026-5430 PUBLISHED

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Assigner: WSO2
Reserved: 02.04.2026 Published: 06.08.2026 Updated: 06.08.2026

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor WSO2
Product WSO2 Universal Gateway
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.57 (excl.)
  • affected from 4.6.0 to 4.6.0.21 (excl.)
Vendor WSO2
Product WSO2 Traffic Manager
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.56 (excl.)
  • affected from 4.6.0 to 4.6.0.21 (excl.)
Vendor WSO2
Product WSO2 API Control Plane
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.58 (excl.)
  • affected from 4.6.0 to 4.6.0.22 (excl.)
Vendor WSO2
Product WSO2 API Manager
Versions Default: unaffected
  • unknown from 0 to 4.1.0 (excl.)
  • affected from 4.1.0 to 4.1.0.257 (excl.)
  • affected from 4.2.0 to 4.2.0.197 (excl.)
  • affected from 4.3.0 to 4.3.0.108 (excl.)
  • affected from 4.4.0 to 4.4.0.72 (excl.)
  • affected from 4.5.0 to 4.5.0.57 (excl.)
  • affected from 4.6.0 to 4.6.0.21 (excl.)
Vendor WSO2
Product WSO2 Carbon API Manager Rest API Utility
Versions Default: unknown
  • affected from 9.20.74 to 9.20.74.401 (excl.)
  • affected from 9.28.116 to 9.28.116.417 (excl.)
  • affected from 9.29.120 to 9.29.120.236 (excl.)
  • affected from 9.30.67 to 9.30.67.167 (excl.)
  • affected from 9.31.86 to 9.31.86.158 (excl.)
  • affected from 9.32.147 to 9.32.147.59 (excl.)
  • unaffected from 9.33.106 to * (incl.)

Solutions

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution

Credits

  • hacktron.ai finder

References

Problem Types

  • CWE-347: Improper Validation of Certificate With Host Mismatch CWE

Impacts

  • CAPEC-239 CAPEC-239: Token Verification Bypass