CVE-2026-5430: listed in the CISA KEV catalog CVE-2026-5430 · CVSS 10.0 CRITICAL · EPSS 22% · KEV 2026-09-24 · patch available
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Is CVE-2026-5430 exploited? Listed in the CISA KEV catalog on 2026-09-24. Federal remediation due 2026-09-27. Past that date by 47 days. EPSS puts exploitation in the next 30 days at 22%. Public exploit code: none found in monitored sources. Which products and versions are affected? WSO2 · WSO2 Universal Gateway · >= 4.5.0, < 4.5.0.57, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 Traffic Manager · >= 4.5.0, < 4.5.0.56, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 API Control Plane · >= 4.5.0, < 4.5.0.58, >= 4.6.0, < 4.6.0.22 WSO2 · WSO2 API Manager · >= 0, < 4.1.0, >= 4.1.0, < 4.1.0.257, >= 4.2.0, < 4.2.0.197, >= 4.3.0, < 4.3.0.108, >= 4.4.0, < 4.4.0.72, >= 4.5.0, < 4.5.0.57, +1 more WSO2 · WSO2 Carbon API Manager Rest API Utility · >= 9.20.74, < 9.20.74.401, >= 9.28.116, < 9.28.116.417, >= 9.29.120, < 9.29.120.236, >= 9.30.67, < 9.30.67.167, >= 9.31.86, < 9.31.86.158, >= 9.32.147, < 9.32.147.59 Is there a patch? Yes. Update to one of these or later:
WSO2 Universal Gateway 4.5.0 4.5.0.57 WSO2 Universal Gateway 4.6.0 4.6.0.21 WSO2 Traffic Manager 4.5.0 4.5.0.56 WSO2 Traffic Manager 4.6.0 4.6.0.21 WSO2 API Control Plane 4.5.0 4.5.0.58 WSO2 API Control Plane 4.6.0 4.6.0.22 WSO2 API Manager 4.1.0 4.1.0.257 WSO2 API Manager 4.2.0 4.2.0.197 WSO2 API Manager 4.3.0 4.3.0.108 WSO2 API Manager 4.4.0 4.4.0.72 WSO2 API Manager 4.5.0 4.5.0.57 WSO2 API Manager 4.6.0 4.6.0.21 WSO2 Carbon API Manager Rest API Utility 9.20.74 9.20.74.401 WSO2 Carbon API Manager Rest API Utility 9.28.116 9.28.116.417 WSO2 Carbon API Manager Rest API Utility 9.29.120 9.29.120.236 WSO2 Carbon API Manager Rest API Utility 9.30.67 9.30.67.167 WSO2 Carbon API Manager Rest API Utility 9.31.86 9.31.86.158 WSO2 Carbon API Manager Rest API Utility 9.32.147 9.32.147.59
From WSO2's CVE record · WSO2 advisory
What PlainSec published about CVE-2026-5430 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-25.
CVE-2026-5430: listed in the CISA KEV catalog CVE-2026-5430 · CVSS 10.0 CRITICAL · EPSS 22% · KEV 2026-09-24 · patch available
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Is CVE-2026-5430 exploited? Listed in the CISA KEV catalog on 2026-09-24. Federal remediation due 2026-09-27. Past that date by 47 days. EPSS puts exploitation in the next 30 days at 22%. Public exploit code: none found in monitored sources. Which products and versions are affected? WSO2 · WSO2 Universal Gateway · >= 4.5.0, < 4.5.0.57, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 Traffic Manager · >= 4.5.0, < 4.5.0.56, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 API Control Plane · >= 4.5.0, < 4.5.0.58, >= 4.6.0, < 4.6.0.22 WSO2 · WSO2 API Manager · >= 0, < 4.1.0, >= 4.1.0, < 4.1.0.257, >= 4.2.0, < 4.2.0.197, >= 4.3.0, < 4.3.0.108, >= 4.4.0, < 4.4.0.72, >= 4.5.0, < 4.5.0.57, +1 more WSO2 · WSO2 Carbon API Manager Rest API Utility · >= 9.20.74, < 9.20.74.401, >= 9.28.116, < 9.28.116.417, >= 9.29.120, < 9.29.120.236, >= 9.30.67, < 9.30.67.167, >= 9.31.86, < 9.31.86.158, >= 9.32.147, < 9.32.147.59 Is there a patch? Yes. Update to one of these or later:
WSO2 Universal Gateway 4.5.0 4.5.0.57 WSO2 Universal Gateway 4.6.0 4.6.0.21 WSO2 Traffic Manager 4.5.0 4.5.0.56 WSO2 Traffic Manager 4.6.0 4.6.0.21 WSO2 API Control Plane 4.5.0 4.5.0.58 WSO2 API Control Plane 4.6.0 4.6.0.22 WSO2 API Manager 4.1.0 4.1.0.257 WSO2 API Manager 4.2.0 4.2.0.197 WSO2 API Manager 4.3.0 4.3.0.108 WSO2 API Manager 4.4.0 4.4.0.72 WSO2 API Manager 4.5.0 4.5.0.57 WSO2 API Manager 4.6.0 4.6.0.21 WSO2 Carbon API Manager Rest API Utility 9.20.74 9.20.74.401 WSO2 Carbon API Manager Rest API Utility 9.28.116 9.28.116.417 WSO2 Carbon API Manager Rest API Utility 9.29.120 9.29.120.236 WSO2 Carbon API Manager Rest API Utility 9.30.67 9.30.67.167 WSO2 Carbon API Manager Rest API Utility 9.31.86 9.31.86.158 WSO2 Carbon API Manager Rest API Utility 9.32.147 9.32.147.59
From WSO2's CVE record · WSO2 advisory
What PlainSec published about CVE-2026-5430 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-25.