Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Affects WSO2 API Manager 4.1.0 through 4.6.0 and several WSO2 gateway, traffic and control plane products. Fixed in per-branch builds, such as 4.6.0.21 for API Manager 4.6.0.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 4.5.0.57, 4.6.0.21, 4.5.0.56, 4.5.0.58, 4.6.0.22, and 10 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
This vulnerability affects multiple WSO2 products that use JWT-based authentication. An attacker could forge tokens using an unsupported signing algorithm, potentially gaining unauthorized access, including administrative accounts and full control of affected accounts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- WSO2 WSO2 Universal Gateway
From 4.5.0 · fixed in 4.5.0.57; From 4.6.0 · fixed in 4.6.0.21
- WSO2 WSO2 Traffic Manager
From 4.5.0 · fixed in 4.5.0.56; From 4.6.0 · fixed in 4.6.0.21
- WSO2 WSO2 API Control Plane
From 4.5.0 · fixed in 4.5.0.58; From 4.6.0 · fixed in 4.6.0.22
- WSO2 WSO2 API Manager
From 4.1.0 · fixed in 4.1.0.257; From 4.2.0 · fixed in 4.2.0.197; From 4.3.0 · fixed in 4.3.0.108; From 4.4.0 · fixed in 4.4.0.72; From 4.5.0 · fixed in 4.5.0.57; From 4.6.0 · fixed in 4.6.0.21
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
From 9.20.74 · fixed in 9.20.74.401; From 9.28.116 · fixed in 9.28.116.417; From 9.29.120 · fixed in 9.29.120.236; From 9.30.67 · fixed in 9.30.67.167; From 9.31.86 · fixed in 9.31.86.158; From 9.32.147 · fixed in 9.32.147.59
References 1
security.docs.wso2.com
Questions about CVE-2026-5430
What does this mean?
JWT authentication can be bypassed when a token is signed using an unsupported algorithm. The advisory says this may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.Source: security.docs.wso2.com
Am I affected, and how do I check?
The advisory lists WSO2 API Manager 4.1.0 through 4.6.0, WSO2 API Control Plane, WSO2 Traffic Manager, WSO2 Universal Gateway, and WSO2 Carbon API Manager Rest API Utility. Each product has a fixed build per release branch, so compare the installed build number with the fixed build listed for its branch.Source: security.docs.wso2.com
What should I do about it?
Upgrade to the fixed build for the release branch in use, for example 4.6.0.21 for API Manager 4.6.0 or 4.5.0.57 for API Manager 4.5.0. The facts do not list any other remediation step.Source: security.docs.wso2.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-24, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data