CVE-2026-5430

🗓️ 06 Aug 2026 07:33:28Reported by WSO2Type

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 209 Views

JWT accepts tokens with unsupported algorithms, causing unauthorized access and admin takeover.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane	25 Sep 202620:53	–	githubexploit
attackerkb	CVE-2026-5430	6 Aug 202607:33	–	attackerkb
BDU FSTEC	The vulnerability of the WSO2 platform for integrating application programming interfaces and web services lies in errors in cryptographic signatures. This allows attackers to gain unauthorized access and steal user accounts.	17 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-5430	30 Jun 202602:45	–	circl
CISA KEV Catalog	WSO2 Multiple Products Path Traversal Vulnerability	24 Sep 202600:00	–	cisa_kev
Cvelist	CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover	6 Aug 202607:33	–	cvelist
EUVD	EUVD-2026-53822	6 Aug 202607:33	–	euvd
Kitploit	CVE-2026-5430	23 Sep 202605:00	–	kitploit
NVD	CVE-2026-5430	6 Aug 202608:16	–	nvd
Positive Technologies	PT-2026-53824	30 Jun 202600:00	–	ptsecurity

NVD

Node

wso2 api_control_planeRange4.5.0–4.5.0.58

wso2 api_control_planeRange4.6.0–4.6.0.22

Node

wso2 api_managerRange4.1.0–4.1.0.257

wso2 api_managerRange4.2.0–4.2.0.197

wso2 api_managerRange4.3.0–4.3.0.108

wso2 api_managerRange4.4.0–4.4.0.72

wso2 api_managerRange4.5.0–4.5.0.57

wso2 api_managerRange4.6.0–4.6.0.21

Node

wso2 traffic_managerRange4.5.0–4.5.0.56

wso2 traffic_managerRange4.6.0–4.6.0.21

Node

wso2 universal_gatewayRange4.5.0–4.5.0.57

wso2 universal_gatewayRange4.6.0–4.6.0.21

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Universal Gateway",
    "versions": [
      {
        "status": "affected",
        "version": "4.5.0",
        "lessThan": "4.5.0.57",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.6.0",
        "lessThan": "4.6.0.21",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Traffic Manager",
    "versions": [
      {
        "status": "affected",
        "version": "4.5.0",
        "lessThan": "4.5.0.56",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.6.0",
        "lessThan": "4.6.0.21",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 API Control Plane",
    "versions": [
      {
        "status": "affected",
        "version": "4.5.0",
        "lessThan": "4.5.0.58",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.6.0",
        "lessThan": "4.6.0.22",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 API Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "4.1.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.0.257",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.2.0",
        "lessThan": "4.2.0.197",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.3.0",
        "lessThan": "4.3.0.108",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.4.0",
        "lessThan": "4.4.0.72",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.5.0",
        "lessThan": "4.5.0.57",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.6.0",
        "lessThan": "4.6.0.21",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon API Manager Rest API Utility",
    "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
    "versions": [
      {
        "status": "affected",
        "version": "9.20.74",
        "lessThan": "9.20.74.401",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.28.116",
        "lessThan": "9.28.116.417",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.29.120",
        "lessThan": "9.29.120.236",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.30.67",
        "lessThan": "9.30.67.167",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.31.86",
        "lessThan": "9.31.86.158",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "9.32.147",
        "lessThan": "9.32.147.59",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "9.33.106",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

25 Sep 2026 12:53Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.110

EPSS0.0058

SSVC