CVE-2026-5430WSO2 API Manager accepts JWTs signed with unconfigured algorithms
What broke
CVE-2026-5430 is a JWT verification flaw (CWE-347, improper verification of a cryptographic signature) in WSO2 API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, and Universal Gateway 4.5.0 and 4.6.0. The JWT authentication mechanism accepted tokens signed with algorithms other than the ones configured, so an attacker could craft a token with an unsupported algorithm and have it validated. WSO2 says the result can be compromise of administrative accounts and full account takeover. CVSS 3.1 is 10.0, or 9.8 in single-tenant deployments.
WSO2 published advisory WSO2-2026-5328 on May 3, 2026, credited to the Hacktron team. CISA added the CVE to KEV on September 24, 2026, 144 days later. CISA's KEV entry names it a path traversal leading to file upload and code execution, which does not match WSO2's and NVD's description of a JWT algorithm flaw. We follow the vendor and NVD on the root cause and note the discrepancy.
Why it matters
An API gateway is a token relying party for every API behind it. If it lets the token choose its own verification algorithm, the signature means nothing and any claim, including an admin subject, is believable. This is the same mistake as SimpleHelp and the WordPress OAuth plugin: the verifier trusted the token's header.
What to do
- Support customers: move to the update levels in WSO2-2026-5328 (for example API Manager 4.5.0 level 57, 4.4.0 level 72).
- Open-source users: apply carbon-apimgt pull request 13752 and product-apim pull request 14167, or upgrade.
- Pin accepted JWT algorithms per issuer in gateway config and reject any token whose
algis not on that list.
After you patch
- Reset admin and publisher credentials, and review API and application ownership changes since May 2026.
- Rotate the gateway's signing keys and any backend credentials held in API definitions.
Sources
Related identity CVEs
Related on Start with Identity
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVESharePoint JWT alg:none, impersonate any user
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576