WSO2 Identity Server JWT Auth Bypass via Unsupported Alg CVE-2026-5430
CVE-2026-5430 Published on August 6, 2026
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Known Exploited Vulnerability
This WSO2 Multiple Products Path Traversal Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. .
The following remediation steps are recommended / required by September 27, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab
Vulnerability Analysis
CVE-2026-5430 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
Products Associated with CVE-2026-5430
Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.
Affected Versions
WSO2 Universal Gateway:- Version 4.5.0 and below 4.5.0.57 is affected.
- Version 4.6.0 and below 4.6.0.21 is affected.
- Version 4.5.0 and below 4.5.0.56 is affected.
- Version 4.6.0 and below 4.6.0.21 is affected.
- Version 4.5.0 and below 4.5.0.58 is affected.
- Version 4.6.0 and below 4.6.0.22 is affected.
- Before 4.1.0 is unknown.
- Version 4.1.0 and below 4.1.0.257 is affected.
- Version 4.2.0 and below 4.2.0.197 is affected.
- Version 4.3.0 and below 4.3.0.108 is affected.
- Version 4.4.0 and below 4.4.0.72 is affected.
- Version 4.5.0 and below 4.5.0.57 is affected.
- Version 4.6.0 and below 4.6.0.21 is affected.
- Version 9.20.74 and below 9.20.74.401 is affected.
- Version 9.28.116 and below 9.28.116.417 is affected.
- Version 9.29.120 and below 9.29.120.236 is affected.
- Version 9.30.67 and below 9.30.67.167 is affected.
- Version 9.31.86 and below 9.31.86.158 is affected.
- Version 9.32.147 and below 9.32.147.59 is affected.
- Version 9.33.106, <= * is unaffected.