# WSO2 API Manager accepts JWTs signed with unconfigured algorithms

Source: https://startwithidentity.com/cves/cve-2026-5430/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-5430 is a JWT verification flaw (CWE-347, improper verification of a cryptographic signature) in [WSO2](https://startwithidentity.com/vendors/iam/wso2/) API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, and Universal Gateway 4.5.0 and 4.6.0. The JWT authentication mechanism accepted tokens signed with algorithms other than the ones configured, so an attacker could craft a token with an unsupported algorithm and have it validated. WSO2 says the result can be compromise of administrative accounts and full account takeover. CVSS 3.1 is 10.0, or 9.8 in single-tenant deployments.

WSO2 published advisory WSO2-2026-5328 on May 3, 2026, credited to the Hacktron team. CISA added the CVE to KEV on September 24, 2026, 144 days later. CISA's KEV entry names it a path traversal leading to file upload and code execution, which does not match WSO2's and NVD's description of a JWT algorithm flaw. We follow the vendor and NVD on the root cause and note the discrepancy.

## Why it matters

An API gateway is a token relying party for every API behind it. If it lets the token choose its own verification algorithm, the signature means nothing and any claim, including an admin subject, is believable. This is the same mistake as [SimpleHelp](https://startwithidentity.com/cves/cve-2026-48558/) and the [WordPress OAuth plugin](https://startwithidentity.com/cves/cve-2025-9485/): the verifier trusted the token's header.

## What to do

- Support customers: move to the update levels in WSO2-2026-5328 (for example API Manager 4.5.0 level 57, 4.4.0 level 72).
- Open-source users: apply carbon-apimgt pull request 13752 and product-apim pull request 14167, or upgrade.
- Pin accepted JWT algorithms per issuer in gateway config and reject any token whose `alg` is not on that list.

## After you patch

- Reset admin and publisher credentials, and review API and application ownership changes since May 2026.
- Rotate the gateway's signing keys and any backend credentials held in API definitions.

## Sources

- [NVD: CVE-2026-5430](https://nvd.nist.gov/vuln/detail/cve-2026-5430)
- [WSO2 security advisory WSO2-2026-5328](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)
- [CISA Known Exploited Vulnerabilities catalog, added September 24, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430)