CVE-2026-5430WSO2 API Manager accepts JWTs signed with unconfigured algorithms
What broke
CVE-2026-5430 is a JWT verification flaw (CWE-347, improper verification of a cryptographic signature) in WSO2 API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, and Universal Gateway 4.5.0 and 4.6.0. The JWT authentication mechanism accepted tokens signed with algorithms other than the ones configured, so an attacker could craft a token with an unsupported algorithm and have it validated. WSO2 says the result can be compromise of administrative accounts and full account takeover. CVSS 3.1 is 10.0, or 9.8 in single-tenant deployments.
WSO2 published advisory WSO2-2026-5328 on May 3, 2026, credited to the Hacktron team. CISA added the CVE to KEV on September 24, 2026, 144 days later. CISA's KEV entry names it a path traversal leading to file upload and code execution, which does not match WSO2's and NVD's description of a JWT algorithm flaw. We follow the vendor and NVD on the root cause and note the discrepancy.
Why it matters
An API gateway is a token relying party for every API behind it. If it lets the token choose its own verification algorithm, the signature means nothing and any claim, including an admin subject, is believable. This is the same mistake as SimpleHelp and the WordPress OAuth plugin: the verifier trusted the token's header.
What to do
- Support customers: move to the update levels in WSO2-2026-5328 (for example API Manager 4.5.0 level 57, 4.4.0 level 72).
- Open-source users: apply carbon-apimgt pull request 13752 and product-apim pull request 14167, or upgrade.
- Pin accepted JWT algorithms per issuer in gateway config and reject any token whose
algis not on that list.
After you patch
- Reset admin and publisher credentials, and review API and application ownership changes since May 2026.
- Rotate the gateway's signing keys and any backend credentials held in API definitions.
Sources
Related identity CVEs
Related on Start with Identity
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVESharePoint JWT alg:none, impersonate any user
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so