CVE-2026-5430Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC available

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leadin…

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score80/ 100 · Severe

impact 55 · likelihood 0.1 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Aug 6, 2026

Updated

Sep 25, 2026

CVSS

10.0

Vendor

wso2

Product

api_control_plane

CWE

CWE-347

Depth score

80 · Severe

EPSS

0.37% · p29

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-25

GitHub PoCs

1 public repository

HORKimhab/CVE-2026-5430 ↗

CISA SSVC

decided 2026-09-24

Exploitation: active
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 24.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 50 days

Aug 6, 2026Published
Disclosed via NVD
Sep 24, 2026Added to CISA KEV
Federal remediation due Sep 27, 2026
Sep 24, 2026EPSS first tracked
0.4%
Sep 25, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026Public exploit observed
1 GitHub repo (last check)

wso2 CWE-347 #nvd #cve.org #in-the-wild #exploit-available #kev

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Sep 24, 2026. Federal remediation due Sep 27, 2026. View catalog ↗

Affected

api_control_plane >= 4.5.0, < 4.5.0.58
api_control_plane >= 4.6.0, < 4.6.0.22
api_manager >= 4.1.0, < 4.1.0.257
api_manager >= 4.2.0, < 4.2.0.197
api_manager >= 4.3.0, < 4.3.0.108
api_manager >= 4.4.0, < 4.4.0.72
api_manager >= 4.5.0, < 4.5.0.57
api_manager >= 4.6.0, < 4.6.0.21
traffic_manager >= 4.5.0, < 4.5.0.56
traffic_manager >= 4.6.0, < 4.6.0.21
universal_gateway >= 4.5.0, < 4.5.0.57
universal_gateway >= 4.6.0, < 4.6.0.21

Patched in

api_control_plane 4.6.0.22
api_manager 4.6.0.21
traffic_manager 4.6.0.21
universal_gateway 4.6.0.21

Full technical detail▾

Overview

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Affected

api_control_plane >= 4.5.0, < 4.5.0.58
api_control_plane >= 4.6.0, < 4.6.0.22
api_manager >= 4.1.0, < 4.1.0.257
api_manager >= 4.2.0, < 4.2.0.197
api_manager >= 4.3.0, < 4.3.0.108
api_manager >= 4.4.0, < 4.4.0.72
api_manager >= 4.5.0, < 4.5.0.57
api_manager >= 4.6.0, < 4.6.0.21
traffic_manager >= 4.5.0, < 4.5.0.56
traffic_manager >= 4.6.0, < 4.6.0.21
universal_gateway >= 4.5.0, < 4.5.0.57
universal_gateway >= 4.6.0, < 4.6.0.21

Remediation

Upgrade past the affected range:

api_control_plane 4.6.0.22
api_manager 4.6.0.21
traffic_manager 4.6.0.21
universal_gateway 4.6.0.21

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#in-the-wild#exploit-available#kev

← Back to feed

CVE-2026-5430Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC available

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score80/ 100 · Severe

impact 55 · likelihood 0.1 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Aug 6, 2026

Updated

Sep 25, 2026

CVSS

10.0

Vendor

wso2

Product

api_control_plane

CWE

CWE-347

Depth score

80 · Severe

EPSS

0.37% · p29

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-25

GitHub PoCs

1 public repository

HORKimhab/CVE-2026-5430 ↗

CISA SSVC

decided 2026-09-24

Exploitation: active
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 24.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 50 days

Aug 6, 2026Published
Disclosed via NVD
Sep 24, 2026Added to CISA KEV
Federal remediation due Sep 27, 2026
Sep 24, 2026EPSS first tracked
0.4%
Sep 25, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026Public exploit observed
1 GitHub repo (last check)

wso2 CWE-347 #nvd #cve.org #in-the-wild #exploit-available #kev

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Sep 24, 2026. Federal remediation due Sep 27, 2026. View catalog ↗

Affected

api_control_plane >= 4.5.0, < 4.5.0.58
api_control_plane >= 4.6.0, < 4.6.0.22
api_manager >= 4.1.0, < 4.1.0.257
api_manager >= 4.2.0, < 4.2.0.197
api_manager >= 4.3.0, < 4.3.0.108
api_manager >= 4.4.0, < 4.4.0.72
api_manager >= 4.5.0, < 4.5.0.57
api_manager >= 4.6.0, < 4.6.0.21
traffic_manager >= 4.5.0, < 4.5.0.56
traffic_manager >= 4.6.0, < 4.6.0.21
universal_gateway >= 4.5.0, < 4.5.0.57
universal_gateway >= 4.6.0, < 4.6.0.21

Patched in

api_control_plane 4.6.0.22
api_manager 4.6.0.21
traffic_manager 4.6.0.21
universal_gateway 4.6.0.21

Full technical detail▾

Overview

Affected

api_control_plane >= 4.5.0, < 4.5.0.58
api_control_plane >= 4.6.0, < 4.6.0.22
api_manager >= 4.1.0, < 4.1.0.257
api_manager >= 4.2.0, < 4.2.0.197
api_manager >= 4.3.0, < 4.3.0.108
api_manager >= 4.4.0, < 4.4.0.72
api_manager >= 4.5.0, < 4.5.0.57
api_manager >= 4.6.0, < 4.6.0.21
traffic_manager >= 4.5.0, < 4.5.0.56
traffic_manager >= 4.6.0, < 4.6.0.21
universal_gateway >= 4.5.0, < 4.5.0.57
universal_gateway >= 4.6.0, < 4.6.0.21

Remediation

Upgrade past the affected range:

api_control_plane 4.6.0.22
api_manager 4.6.0.21
traffic_manager 4.6.0.21
universal_gateway 4.6.0.21

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#in-the-wild#exploit-available#kev