CVE-2026-5430

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.59%
EPSS Percentile: 46.59%
CISA KEV: YES — Known Exploited Vulnerability

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
Published: 06-Aug-2026 15:16
Last Modified: 25-Sep-2026 19:53
EPSS Date: 2026-10-11
CWE: CWE-347

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-09-24
Remediation Due: 2026-09-27
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430

Affected Products / Versions

wso2 / api_control_plane
Version / affected range: * · from (inclusive) 4.5.0 · before (exclusive) 4.5.0.58
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*
wso2 / api_control_plane
Version / affected range: * · from (inclusive) 4.6.0 · before (exclusive) 4.6.0.22
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.1.0 · before (exclusive) 4.1.0.257
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.2.0 · before (exclusive) 4.2.0.197
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.3.0 · before (exclusive) 4.3.0.108
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.4.0 · before (exclusive) 4.4.0.72
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.5.0 · before (exclusive) 4.5.0.57
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / api_manager
Version / affected range: * · from (inclusive) 4.6.0 · before (exclusive) 4.6.0.21
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 / traffic_manager
Version / affected range: * · from (inclusive) 4.5.0 · before (exclusive) 4.5.0.56
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*
wso2 / traffic_manager
Version / affected range: * · from (inclusive) 4.6.0 · before (exclusive) 4.6.0.21
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*
wso2 / universal_gateway
Version / affected range: * · from (inclusive) 4.5.0 · before (exclusive) 4.5.0.57
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*
wso2 / universal_gateway
Version / affected range: * · from (inclusive) 4.6.0 · before (exclusive) 4.6.0.21
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 19:12
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CISA Adds Two Actively Exploited WSO2 and Adobe Commerce Vulnerabilities to KEV Catalog

CVE (1)

Vendors (2)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.