- Description
- The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
- Source
- ed10eef1-636d-4fbe-9993-6890dfa878f8
- NVD status
- Analyzed
- Products
- api_control_plane, api_manager, traffic_manager, universal_gateway
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- ed10eef1-636d-4fbe-9993-6890dfa878f8
- CWE-347
- Hype score
- Not currently trending
๐จ WSO2 has patched four critical account takeover vulnerabilities, including CVE-2026-5430 (CVSS 10.0). The flaw allows authentication bypass via JWT, potentially leading to full account compromise. Users are urged to update immediately. #WSO2 #JWT #CVE #CyberSecurity
@ThreatWire_
7 Aug 2026
642 Impressions
0 Retweets
9 Likes
4 Bookmarks
0 Replies
0 Quotes
๐ก๏ธ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-11976 CVE-2026-14812 CVE-2026-5430 CVE-2026-65553 CVE-2026-66665 ..๐งต๐
@exploitgrid
7 Aug 2026
36 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside. #WSO2 #AccountTakeover #CVE #APIsecurity #CyberSecurity https://t.co/pbUTKa9Owi
@Daily_CyberSec
7 Aug 2026
414 Impressions
1 Retweet
1 Like
1 Bookmark
1 Reply
0 Quotes
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. ๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 6 Aug 2026 ๐๐น๐ฟ๐ฒ๐ฎ๐ฑ๐ ๐ฐ๐ผ๐๐ฒ๐ฟ๐ฒ๐ฑ: ๐ JWT accepted with an algorithm the server never configure
@NewScanTeam
6 Aug 2026
16 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
๐จ*CVE* CVE-2026-5430 The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with โฆ https://t.co/WePAaQe5Pt ----- Traducciรณn: CVE-2026-5430 El โฆ https://t.co/utmtNg
@infoflowcloud
6 Aug 2026
33 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5F568AE3-DBF2-41B6-B4C8-20B655067056",
"versionEndExcluding": "4.5.0.58",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7C020DC7-BD0F-4C0B-8CBC-4B93671D4CAC",
"versionEndExcluding": "4.6.0.22",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE140289-0624-4385-8D46-D6E5052D3B28",
"versionEndExcluding": "4.1.0.257",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31FC9528-42DB-4E23-BCF4-674397F2E626",
"versionEndExcluding": "4.2.0.197",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5F10E50C-D77F-4779-936C-0ADDF8B1B1F6",
"versionEndExcluding": "4.3.0.108",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8774AF32-FAEC-4EF3-8399-8E76D55A8DEB",
"versionEndExcluding": "4.4.0.72",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D4DD9A69-BED3-45B4-9521-DBCA9AEBBF6F",
"versionEndExcluding": "4.5.0.57",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "07437626-95AF-4468-8479-ACC2835DF708",
"versionEndExcluding": "4.6.0.21",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "066D4334-A3B2-4D0D-9830-1CBE6C91B053",
"versionEndExcluding": "4.5.0.56",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6F904CBB-EC8F-49F3-B85D-E934E785813B",
"versionEndExcluding": "4.6.0.21",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6AA06D88-B2E9-4474-A12E-3D44FC7E6A6B",
"versionEndExcluding": "4.5.0.57",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD535B3-3554-4F39-AA9A-8A0178A44490",
"versionEndExcluding": "4.6.0.21",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]