CVE-2026-5430: WSO2 API Manager JWT Auth Bypass
CVE-2026-5430 is a critical JWT algorithm-confusion flaw across WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway: the JWT validator accepts tokens signed with an unsupported algorithm, letting a remote attacker forge a token that is incorrectly accepted and reach unauthorized access, up to full administrative account takeover, and it is listed in the CISA KEV catalog as actively exploited.
Vulnerability summary
| Vulnerability ID | CVE-2026-5430 |
|---|---|
| CVSS score | 10 |
| EPSS score | 0.2239 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-08-06T08:16:33.240 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| WSO2 API Manager | cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 4.1.0 up to (excluding) 4.1.0.257; 4.2.0 up to 4.2.0.197; 4.3.0 up to 4.3.0.108; 4.4.0 up to 4.4.0.72; 4.5.0 up to 4.5.0.57; 4.6.0 up to 4.6.0.21 |
| WSO2 API Control Plane | cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* | 4.5.0 up to (excluding) 4.5.0.58; 4.6.0 up to 4.6.0.22 |
| WSO2 Traffic Manager | cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* | 4.5.0 up to (excluding) 4.5.0.56; 4.6.0 up to 4.6.0.21 |
| WSO2 Universal Gateway | cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* | 4.5.0 up to (excluding) 4.5.0.57; 4.6.0 up to 4.6.0.21 |
What this means
CVE-2026-5430 is a CWE-347 (Improper Verification of Cryptographic Signature) flaw affecting WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway. NVD's description states: "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover" (NVD).
NVD lists this CVE as fully analyzed (status "Analyzed") with a CVSS v3.1 base score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the maximum possible score, reflecting network reach, low attack complexity, no privileges or user interaction required, a scope change, and high impact to confidentiality, integrity and availability. The score is sourced from the assigning CNA and carried as the record's full severity data once NVD completed its review (NVD).
CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-24, with a required-action due date of 2026-09-27 and known ransomware campaign use listed as "Unknown." The catalog entry's own vulnerability name and short description frame the flaw as enabling "unrestricted file upload" leading to remote code execution — a slightly different framing from NVD's JWT-forgery description, but both sources agree on the CWE-347 signature-verification root cause and on treating the flaw as critical and actively exploited (CISA KEV).
WSO2's own security advisory (WSO2-2026-5328) is the authoritative source CISA cites for the affected product list and fixed builds, but it returned HTTP 403 when fetched directly during this review. In its place, this page relies on NVD's CNA-submitted CPE data (reproduced in Affected Components above) and the CISA KEV entry for the affected-product and remediation framing; readers should also consult the vendor advisory directly for upgrade steps once it is reachable.
As of 2026-10-26, FIRST scores the probability of exploitation at 0.2239 (97.68th percentile) — a moderate absolute score but high relative to most CVEs, consistent with a vulnerability that is being actively exploited per KEV but against a narrower, enterprise-API-gateway install base than a mass-market product (FIRST EPSS).
Because this flaw can lead to full administrative account takeover of API management infrastructure, any WSO2 API Manager, API Control Plane, Traffic Manager or Universal Gateway deployment on an affected build should be upgraded to a patched version immediately, and operators should review authentication logs for signs of forged-JWT access attempts.
Evidence
- JWT authentication accepts tokens signed with unsupported algorithms, which are incorrectly validated, allowing unauthorized access up to administrative account takeover (CWE-347). — NVD
- NVD status is Analyzed with CVSS v3.1 base score 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-24, due date 2026-09-27, ransomware use Unknown; catalog frames it as enabling unrestricted file upload / RCE. — CISA KEV
- Affects WSO2 API Manager 4.1.0-4.6.0.x, API Control Plane 4.5.0-4.6.0.x, Traffic Manager 4.5.0-4.6.0.x and Universal Gateway 4.5.0-4.6.0.x in the specific sub-ranges listed, per NVD's CNA-submitted CPE configuration data. — NVD
- EPSS score is 0.2239 (97.68th percentile) as of 2026-10-26. — FIRST EPSS