CVE-2026-5430

Awaiting Analysis Awaiting Analysis - Queue

JWT Algorithm Confusion Leading to Unauthorized Access

Publication date: 2026-08-06

Last updated on: 2026-08-10

Assigner: WSO2 LLC

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-10

Generated

2026-08-17

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-16

NVD

CVE-2026-5430

EUVD

EUVD-2026-53822

Affected Vendors & Products

Vendor	Product	Version / Range
wso2	api_control_plane	From 4.5.0 (inc) to 4.5.0.58 (exc)
wso2	api_control_plane	From 4.6.0 (inc) to 4.6.0.22 (exc)
wso2	api_manager	From 4.1.0 (inc) to 4.1.0.257 (exc)
wso2	api_manager	From 4.2.0 (inc) to 4.2.0.197 (exc)
wso2	api_manager	From 4.3.0 (inc) to 4.3.0.108 (exc)
wso2	api_manager	From 4.4.0 (inc) to 4.4.0.72 (exc)
wso2	api_manager	From 4.5.0 (inc) to 4.5.0.57 (exc)
wso2	api_manager	From 4.6.0 (inc) to 4.6.0.21 (exc)
wso2	traffic_manager	From 4.5.0 (inc) to 4.5.0.56 (exc)
wso2	traffic_manager	From 4.6.0 (inc) to 4.6.0.21 (exc)
wso2	universal_gateway	From 4.5.0 (inc) to 4.5.0.57 (exc)
wso2	universal_gateway	From 4.6.0 (inc) to 4.6.0.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves the JWT authentication system accepting tokens signed with unsupported algorithms. Attackers can exploit this by creating a JWT with an invalid algorithm, which the system incorrectly validates, allowing unauthorized access to the system.

Detection Guidance

To detect this vulnerability, inspect JWT tokens in network traffic for unsupported signing algorithms. Use tools like Burp Suite or Wireshark to capture and analyze tokens. Check server logs for authentication failures or unusual access patterns. Verify WSO2 product configurations to ensure only supported algorithms are allowed.

Impact Analysis

Exploitation may lead to unauthorized system access, including compromise of administrative accounts and full account takeover. The impact is severe, with a CVSS score of 9.8, indicating high confidentiality, integrity, and availability impacts.

Compliance Impact

This vulnerability allows unauthorized access and account takeover, which could lead to unauthorized data exposure or modification. For GDPR, this may result in violations of data integrity and confidentiality requirements. For HIPAA, it could compromise protected health information integrity and availability.

Mitigation Strategies

Configure the JWT authentication mechanism to explicitly reject tokens signed with unsupported algorithms. Ensure only trusted algorithms are allowed and validate token signatures strictly.

Hi! I’m here to help you understand CVE-2026-5430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70