CVE-2026-5430: WSO2 API Manager JWT algorithm confusion authentication bypass

Exploited in the wild Critical 10.0 EPSS 22.4%

WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway accept JWTs signed with algorithms other than those configured or supported, so an unauthenticated attacker can forge a token that passes validation and take over accounts, including administrators (CVSS 10.0; 9.8 in single-tenant deployments). WSO2 published advisory WSO2-2026-5328 with update levels and public fixes; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-24.

CVE-2026-5430CVE identifier
10.0CVSS 3.1 base score (critical)
2026-09-24added to CISA's exploited list (US federal deadline 2026-09-27)
22.4%EPSS: chance of exploitation in the next 30 days (higher than 98% of CVEs)
2026-08-06published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Restart the WSO2 server(s) after applying the update.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

WSO2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0 (below the update levels listed as fixed)
WSO2 API Control Plane 4.5.0, 4.6.0
WSO2 Traffic Manager 4.5.0, 4.6.0
WSO2 Universal Gateway 4.5.0, 4.6.0

Fixed in:

WSO2 API Manager 4.6.0 U2 level 21, 4.5.0 level 57, 4.4.0 level 72, 4.3.0 level 108, 4.2.0 level 197, 4.1.0 level 257
WSO2 API Control Plane 4.6.0 level 22, 4.5.0 level 58
WSO2 Traffic Manager 4.6.0 level 21, 4.5.0 level 56
WSO2 Universal Gateway 4.6.0 level 21, 4.5.0 level 57
Open source users: apply wso2/carbon-apimgt PR #13752 and wso2/product-apim PR #14167, or migrate to the latest unaffected version

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Built from source

# Subscription holders: use the WSO2 Updates tool to move to the update level listed for your product/version (or higher).
# Community (open source) users: build with the public fixes
#   https://github.com/wso2/carbon-apimgt/pull/13752
#   https://github.com/wso2/product-apim/pull/14167
# or migrate to the latest unaffected WSO2 release.

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.