---
id: CVE-2026-5430
title: >-
  The JWT authentication mechanism accepts tokens signed with algorithms other
  than those explicitly configured or supported
summary: >-
  The JWT authentication mechanism accepts tokens signed with algorithms other
  than those explicitly configured or supported. This allows an attacker to
  craft a JWT with an unsupported algorithm, which is then incorrectly
  validated, leadin…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-347
vendor: wso2
product: api_control_plane
affected:
  - 'api_control_plane >= 4.5.0, < 4.5.0.58'
  - 'api_control_plane >= 4.6.0, < 4.6.0.22'
  - 'api_manager >= 4.1.0, < 4.1.0.257'
  - 'api_manager >= 4.2.0, < 4.2.0.197'
  - 'api_manager >= 4.3.0, < 4.3.0.108'
  - 'api_manager >= 4.4.0, < 4.4.0.72'
  - 'api_manager >= 4.5.0, < 4.5.0.57'
  - 'api_manager >= 4.6.0, < 4.6.0.21'
  - 'traffic_manager >= 4.5.0, < 4.5.0.56'
  - 'traffic_manager >= 4.6.0, < 4.6.0.21'
  - 'universal_gateway >= 4.5.0, < 4.5.0.57'
  - 'universal_gateway >= 4.6.0, < 4.6.0.21'
patched:
  - api_control_plane 4.6.0.22
  - api_manager 4.6.0.21
  - traffic_manager 4.6.0.21
  - universal_gateway 4.6.0.21
published: '2026-08-06'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T12:53:05.517'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5430'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.0058
epssPercentile: 0.45384
kev: true
kevDateAdded: '2026-09-24'
kevDueDate: '2026-09-27'
kevRansomware: false
exploited: true
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-5430'
    - 'https://github.com/abraxas/CVE-2026-5430'
  checkedAt: '2026-09-26T09:05:49.407Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-24T19:40:03.351836Z'
ingestedAt: '2026-09-24T20:51:40.183Z'
---

## Overview

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

## Affected

- `api_control_plane >= 4.5.0, < 4.5.0.58`
- `api_control_plane >= 4.6.0, < 4.6.0.22`
- `api_manager >= 4.1.0, < 4.1.0.257`
- `api_manager >= 4.2.0, < 4.2.0.197`
- `api_manager >= 4.3.0, < 4.3.0.108`
- `api_manager >= 4.4.0, < 4.4.0.72`
- `api_manager >= 4.5.0, < 4.5.0.57`
- `api_manager >= 4.6.0, < 4.6.0.21`
- `traffic_manager >= 4.5.0, < 4.5.0.56`
- `traffic_manager >= 4.6.0, < 4.6.0.21`
- `universal_gateway >= 4.5.0, < 4.5.0.57`
- `universal_gateway >= 4.6.0, < 4.6.0.21`

## Remediation

Upgrade past the affected range:

- `api_control_plane 4.6.0.22`
- `api_manager 4.6.0.21`
- `traffic_manager 4.6.0.21`
- `universal_gateway 4.6.0.21`