CVE-2026-5430: presente nel catalogo CISA KEV CVE-2026-5430 · CVSS 10.0 CRITICAL · EPSS 22% · KEV 2026-09-24 · patch disponibile
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
CVE-2026-5430 viene sfruttato? Inserito nel catalogo CISA KEV il 2026-09-24. Scadenza di remediation federale: 2026-09-27. Oltre quella data da 47 giorni. EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 22%. Codice di exploit pubblico: nessuno trovato nelle fonti monitorate. Quali prodotti e versioni sono interessati? WSO2 · WSO2 Universal Gateway · >= 4.5.0, < 4.5.0.57, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 Traffic Manager · >= 4.5.0, < 4.5.0.56, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 API Control Plane · >= 4.5.0, < 4.5.0.58, >= 4.6.0, < 4.6.0.22 WSO2 · WSO2 API Manager · >= 0, < 4.1.0, >= 4.1.0, < 4.1.0.257, >= 4.2.0, < 4.2.0.197, >= 4.3.0, < 4.3.0.108, >= 4.4.0, < 4.4.0.72, >= 4.5.0, < 4.5.0.57, +1 more WSO2 · WSO2 Carbon API Manager Rest API Utility · >= 9.20.74, < 9.20.74.401, >= 9.28.116, < 9.28.116.417, >= 9.29.120, < 9.29.120.236, >= 9.30.67, < 9.30.67.167, >= 9.31.86, < 9.31.86.158, >= 9.32.147, < 9.32.147.59 Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
WSO2 Universal Gateway 4.5.0 4.5.0.57 WSO2 Universal Gateway 4.6.0 4.6.0.21 WSO2 Traffic Manager 4.5.0 4.5.0.56 WSO2 Traffic Manager 4.6.0 4.6.0.21 WSO2 API Control Plane 4.5.0 4.5.0.58 WSO2 API Control Plane 4.6.0 4.6.0.22 WSO2 API Manager 4.1.0 4.1.0.257 WSO2 API Manager 4.2.0 4.2.0.197 WSO2 API Manager 4.3.0 4.3.0.108 WSO2 API Manager 4.4.0 4.4.0.72 WSO2 API Manager 4.5.0 4.5.0.57 WSO2 API Manager 4.6.0 4.6.0.21 WSO2 Carbon API Manager Rest API Utility 9.20.74 9.20.74.401 WSO2 Carbon API Manager Rest API Utility 9.28.116 9.28.116.417 WSO2 Carbon API Manager Rest API Utility 9.29.120 9.29.120.236 WSO2 Carbon API Manager Rest API Utility 9.30.67 9.30.67.167 WSO2 Carbon API Manager Rest API Utility 9.31.86 9.31.86.158 WSO2 Carbon API Manager Rest API Utility 9.32.147 9.32.147.59
Dal record CVE di WSO2 · Advisory di WSO2
Cosa ha pubblicato PlainSec su CVE-2026-5430 Fonti primarie KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-10-25.
CVE-2026-5430: presente nel catalogo CISA KEV CVE-2026-5430 · CVSS 10.0 CRITICAL · EPSS 22% · KEV 2026-09-24 · patch disponibile
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
CVE-2026-5430 viene sfruttato? Inserito nel catalogo CISA KEV il 2026-09-24. Scadenza di remediation federale: 2026-09-27. Oltre quella data da 47 giorni. EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 22%. Codice di exploit pubblico: nessuno trovato nelle fonti monitorate. Quali prodotti e versioni sono interessati? WSO2 · WSO2 Universal Gateway · >= 4.5.0, < 4.5.0.57, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 Traffic Manager · >= 4.5.0, < 4.5.0.56, >= 4.6.0, < 4.6.0.21 WSO2 · WSO2 API Control Plane · >= 4.5.0, < 4.5.0.58, >= 4.6.0, < 4.6.0.22 WSO2 · WSO2 API Manager · >= 0, < 4.1.0, >= 4.1.0, < 4.1.0.257, >= 4.2.0, < 4.2.0.197, >= 4.3.0, < 4.3.0.108, >= 4.4.0, < 4.4.0.72, >= 4.5.0, < 4.5.0.57, +1 more WSO2 · WSO2 Carbon API Manager Rest API Utility · >= 9.20.74, < 9.20.74.401, >= 9.28.116, < 9.28.116.417, >= 9.29.120, < 9.29.120.236, >= 9.30.67, < 9.30.67.167, >= 9.31.86, < 9.31.86.158, >= 9.32.147, < 9.32.147.59 Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
WSO2 Universal Gateway 4.5.0 4.5.0.57 WSO2 Universal Gateway 4.6.0 4.6.0.21 WSO2 Traffic Manager 4.5.0 4.5.0.56 WSO2 Traffic Manager 4.6.0 4.6.0.21 WSO2 API Control Plane 4.5.0 4.5.0.58 WSO2 API Control Plane 4.6.0 4.6.0.22 WSO2 API Manager 4.1.0 4.1.0.257 WSO2 API Manager 4.2.0 4.2.0.197 WSO2 API Manager 4.3.0 4.3.0.108 WSO2 API Manager 4.4.0 4.4.0.72 WSO2 API Manager 4.5.0 4.5.0.57 WSO2 API Manager 4.6.0 4.6.0.21 WSO2 Carbon API Manager Rest API Utility 9.20.74 9.20.74.401 WSO2 Carbon API Manager Rest API Utility 9.28.116 9.28.116.417 WSO2 Carbon API Manager Rest API Utility 9.29.120 9.29.120.236 WSO2 Carbon API Manager Rest API Utility 9.30.67 9.30.67.167 WSO2 Carbon API Manager Rest API Utility 9.31.86 9.31.86.158 WSO2 Carbon API Manager Rest API Utility 9.32.147 9.32.147.59
Dal record CVE di WSO2 · Advisory di WSO2
Cosa ha pubblicato PlainSec su CVE-2026-5430 Fonti primarie KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-10-25.