10

CVE-2026-5430

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Api Control Plane Version >= 4.5.0 < 4.5.0.58
Wso2 ≫ Api Control Plane Version >= 4.6.0 < 4.6.0.22
Wso2 ≫ Api Manager Version >= 4.1.0 < 4.1.0.257
Wso2 ≫ Api Manager Version >= 4.2.0 < 4.2.0.197
Wso2 ≫ Api Manager Version >= 4.3.0 < 4.3.0.108
Wso2 ≫ Api Manager Version >= 4.4.0 < 4.4.0.72
Wso2 ≫ Api Manager Version >= 4.5.0 < 4.5.0.57
Wso2 ≫ Api Manager Version >= 4.6.0 < 4.6.0.21
Wso2 ≫ Traffic Manager Version >= 4.5.0 < 4.5.0.56
Wso2 ≫ Traffic Manager Version >= 4.6.0 < 4.6.0.21
Wso2 ≫ Universal Gateway Version >= 4.5.0 < 4.5.0.57
Wso2 ≫ Universal Gateway Version >= 4.6.0 < 4.6.0.21
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.129
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ed10eef1-636d-4fbe-9993-6890dfa878f8 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
Vendor Advisory