CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
Attackers can bypass authentication by crafting JWTs with unsupported algorithms, leading to unauthorized access and potential administrative account takeover in WSO2 products.
- Exploited in the wild
- Since 24 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5430?
CVE-2026-5430 is a critical authentication bypass vulnerability in Wso2 Api Manager, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Weakness: CWE-347
Which versions are affected by CVE-2026-5430?
It affects 4 products.
Products include Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Traffic Manager, Wso2 Universal Gateway.
How do I fix CVE-2026-5430?
No fix has been published for CVE-2026-5430 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 27 Sep 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-5430 being exploited?
Yes. Attackers have exploited CVE-2026-5430 in the wild since at least 24 Sep 2026.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Wso2 Api Manager
- CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
- CVE-2025-9312 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- CVE-2025-10611 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
- CVE-2025-9804 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Sources
Also known as GHSA-j7vh-5w8q-4m4x.