CVE Intelligence
Analysis AI-assisted

CVE-2026-5430: WSO2 Multiple Products JWT Signature Validation Bypass

CVE-2026-5430 affects several WSO2 products, including API Manager, API Control Plane, Traffic Manager, Universal Gateway and the Carbon API Manager REST API Utility. The JWT authentication mechanism can accept tokens signed with algorithms that were not explicitly configured or supported, which may lead to unauthorized access. CISA lists the CVE in the Known Exploited Vulnerabilities catalog, so organizations should prioritize the vendor advisory.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

WSO2 published a security advisory (WSO2-2026-5328) covering several products. The weakness is classified as CWE-347, Improper Verification of Cryptographic Signature, and concerns how JWT tokens are validated when the signing algorithm is not one the product expects. The record's title refers to path traversal, but its description and CWE classification describe a JWT validation flaw; the description is used here.

Impact

  • The record states that successful exploitation may allow unauthorized access, including potential compromise of administrative accounts and full account takeover.
  • The main CVSS entry in the record has a base score of 10 (critical). The description also states an adjusted score of 9.8 for single-tenant deployments. This discrepancy is not resolved by the record.

Affected products and versions

The record lists the following affected ranges. Each range starts at the first version shown and stops before the second one.

  • WSO2 API Control Plane: from 4.6.0 up to 4.6.0.22, and from 4.5.0 up to 4.5.0.58.
  • WSO2 API Manager: from 4.6.0 up to 4.6.0.21, from 4.5.0 up to 4.5.0.57, from 4.4.0 up to 4.4.0.72, from 4.3.0 up to 4.3.0.108, from 4.2.0 up to 4.2.0.197, and from 4.1.0 up to 4.1.0.257.
  • WSO2 Traffic Manager: from 4.5.0 up to 4.5.0.56, and from 4.6.0 up to 4.6.0.21.
  • WSO2 Universal Gateway: from 4.5.0 up to 4.5.0.57, and from 4.6.0 up to 4.6.0.21.
  • WSO2 Carbon API Manager REST API Utility: from 9.20.74 up to 9.20.74.401, from 9.28.116 up to 9.28.116.417, from 9.29.120 up to 9.29.120.236, from 9.30.67 up to 9.30.67.167, from 9.31.86 up to 9.31.86.158, and from 9.32.147 up to 9.32.147.59.

The record's fixes field is empty. The upper limits above are the exclusive bounds given in the affected data, and the vendor advisory should be consulted to confirm the exact fixed builds.

Exploitation status

The CISA KEV entry for this CVE is marked as listed, with a date added of 2026-09-24 and a due date of 2026-09-27. Ransomware use is recorded as unknown. The SSVC data in the record shows exploitation as active and automatable. The EPSS probability in the record is 0.00588 (percentile 0.47448, dated 2026-10-23), which is an estimate of exploitation likelihood and not a confirmation.

Remediation and mitigation

  • Apply the updates or mitigations described in the WSO2 advisory for each product and version in use.
  • Prioritize internet-facing deployments and systems that hold administrative functions.
  • Follow the CISA required action, which asks organizations to apply vendor mitigations and to discontinue use of a product if mitigations are unavailable.
  • Review how JWT validation is configured, including the set of accepted signing algorithms, and confirm that only the expected algorithms are allowed.

Detection guidance

  • Review authentication logs for successful administrative logins or token use that does not match normal identity provider activity.
  • Look for changes to administrative accounts, roles or API configurations that were not made through approved change processes.
  • Preserve logs and evidence before remediation so that a forensic review is possible, in line with the CISA guidance referenced in the KEV entry.

Limitations of the available information

  • The record does not list fixed versions, so the exact patched builds must be confirmed with the vendor advisory.
  • The CVSS scores are inconsistent in the record (10 in the main entry, 9.8 in the description for single-tenant deployments).
  • The title refers to path traversal, while the description and CWE describe JWT signature verification. No path traversal details are present in the record.
  • Ransomware association is unknown in the sources consulted.

Frequently asked questions

Is CVE-2026-5430 known to be exploited?

Yes. The CISA KEV entry for this CVE is marked as listed, and the record's SSVC data shows exploitation as active. The sources consulted do not show ransomware use, which is recorded as unknown.

Which WSO2 products are affected?

The record lists WSO2 API Control Plane, API Manager, Traffic Manager, Universal Gateway and the Carbon API Manager REST API Utility, each with specific affected version ranges.

What should administrators do first?

Check which affected versions are deployed, prioritize internet-facing systems, and follow the WSO2 advisory to apply the vendor updates or mitigations. Review JWT algorithm configuration and logs for unexpected administrative activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.