--- id: "CVE-2026-5430" kind: "vulnerability" aliases: ["CVE-2026-5430"] title: "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or\u2026" severity: "critical" cvss: 10.0 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "WSO2 Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "WSO2 API Manager", "fixed": ["4.6.0 L21", "4.5.0 L57", "4.4.0 L72", "4.3.0 L108", "4.2.0 L197", "4.1.0 L257"], "affected": "4.1.0 to 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 API Control Plane", "fixed": ["4.6.0 L22", "4.5.0 L58"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 Traffic Manager", "fixed": ["4.6.0 L21", "4.5.0 L56"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}, {"name": "WSO2 Universal Gateway", "fixed": ["4.6.0 L21", "4.5.0 L57"], "affected": "4.5.0, 4.6.0", "ecosystem": "vendor"}, {"name": "wso2 api control plane", "fixed": ["4.5.0.58"], "affected": ">= 4.5.0, < 4.5.0.58", "ecosystem": "vendor"}, {"name": "wso2 api control plane", "fixed": ["4.6.0.22"], "affected": ">= 4.6.0, < 4.6.0.22", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.1.0.257"], "affected": ">= 4.1.0, < 4.1.0.257", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.2.0.197"], "affected": ">= 4.2.0, < 4.2.0.197", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.3.0.108"], "affected": ">= 4.3.0, < 4.3.0.108", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.4.0.72"], "affected": ">= 4.4.0, < 4.4.0.72", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.5.0.57"], "affected": ">= 4.5.0, < 4.5.0.57", "ecosystem": "vendor"}, {"name": "wso2 api manager", "fixed": ["4.6.0.21"], "affected": ">= 4.6.0, < 4.6.0.21", "ecosystem": "vendor"}, {"name": "wso2 traffic manager", "fixed": ["4.5.0.56"], "affected": ">= 4.5.0, < 4.5.0.56", "ecosystem": "vendor"}, {"name": "wso2 traffic manager", "fixed": ["4.6.0.21"], "affected": ">= 4.6.0, < 4.6.0.21", "ecosystem": "vendor"}, {"name": "wso2 universal gateway", "fixed": ["4.5.0.57"], "affected": ">= 4.5.0, < 4.5.0.57", "ecosystem": "vendor"}, {"name": "wso2 universal gateway", "fixed": ["4.6.0.21"], "affected": ">= 4.6.0, < 4.6.0.21", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["api-gateway", "api-manager", "auth-bypass", "exploited", "jwt", "self-hosted", "vendor", "wso2"] not_affected_if: ["managed-hosting"] published_at: "2026-08-06T08:16:33+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:03:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:27:47+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5430", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or… WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway have a path traversal flaw that lets an attacker write uploaded files to arbitrary locations. The sources say this can lead to remote code execution, and CISA reports it is being exploited in the wild. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:WSO2 Multiple Products affected ? fixed ? - vendor:WSO2 API Manager affected 4.1.0 to 4.6.0 fixed 4.6.0 L21, 4.5.0 L57, 4.4.0 L72, 4.3.0 L108, 4.2.0 L197, 4.1.0 L257 - vendor:WSO2 API Control Plane affected 4.5.0, 4.6.0 fixed 4.6.0 L22, 4.5.0 L58 - vendor:WSO2 Traffic Manager affected 4.5.0, 4.6.0 fixed 4.6.0 L21, 4.5.0 L56 - vendor:WSO2 Universal Gateway affected 4.5.0, 4.6.0 fixed 4.6.0 L21, 4.5.0 L57 - vendor:wso2 api control plane affected >= 4.5.0, < 4.5.0.58 fixed 4.5.0.58 - vendor:wso2 api control plane affected >= 4.6.0, < 4.6.0.22 fixed 4.6.0.22 - vendor:wso2 api manager affected >= 4.1.0, < 4.1.0.257 fixed 4.1.0.257 - vendor:wso2 api manager affected >= 4.2.0, < 4.2.0.197 fixed 4.2.0.197 - vendor:wso2 api manager affected >= 4.3.0, < 4.3.0.108 fixed 4.3.0.108 - vendor:wso2 api manager affected >= 4.4.0, < 4.4.0.72 fixed 4.4.0.72 - vendor:wso2 api manager affected >= 4.5.0, < 4.5.0.57 fixed 4.5.0.57 - vendor:wso2 api manager affected >= 4.6.0, < 4.6.0.21 fixed 4.6.0.21 - vendor:wso2 traffic manager affected >= 4.5.0, < 4.5.0.56 fixed 4.5.0.56 - vendor:wso2 traffic manager affected >= 4.6.0, < 4.6.0.21 fixed 4.6.0.21 - vendor:wso2 universal gateway affected >= 4.5.0, < 4.5.0.57 fixed 4.5.0.57 - vendor:wso2 universal gateway affected >= 4.6.0, < 4.6.0.21 fixed 4.6.0.21 ## How to check Check the installed WSO2 product version against the affected ranges (API Manager 4.1.0 to 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, Universal Gateway 4.5.0 and 4.6.0). ## Fix Update to the fixed update level for your release line: API Manager 4.6.0 L21, 4.5.0 L57, 4.4.0 L72, 4.3.0 L108, 4.2.0 L197, 4.1.0 L257; API Control Plane 4.6.0 L22 or 4.5.0 L58; Traffic Manager 4.6.0 L21 or 4.5.0 L56; Universal Gateway 4.6.0 L21 or 4.5.0 L57. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430 - 2026-10-23T20:03:34+00:00 analyst — WSO2 advisory WSO2-2026-5328 read: flaw is JWT auth bypass, not path traversal as CISA KEV titles it; versions and update levels from vendor; exploitation per CISA KEV 2026-09-24; PoC and exploit details unknown. - 2026-10-23T21:27:47+00:00 analyst — Re-read vendor advisory WSO2-2026-5328: flaw is JWT auth bypass (unsupported signing algorithm), CVSS 10 (9.8 single-tenant); CISA KEV title 'path traversal' does not match the vendor description. Exploitation per CISA KEV 2026-09-24; public PoC/IOCs unknown, not in advisory. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-5430 ## Documents - [advisory] WSO2-2026-5328 / CVE-2026-5430 vendor advisory https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ - [mentions] CISA adds CVE-2026-5430 to KEV (Sep 24 2026) https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog ## From the sources WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_