Loading vulnerability…
JWT Algorithm Validation Authentication Bypass in WSO2 API Management Products
CVE-2026-5430 is a critical JWT authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The JWT signature-verification and authentication-interceptor logic incorrectly accepts tokens signed using unsupported or non-configured algorithms. Unsupported-algorithm processing can raise an APIManagementException that is logged without marking authentication as failed, allowing requests to proceed to protected REST APIs. The affected processing involves JWTUtil.verifyTokenSignature() and OAuthAuthenticationInterceptor. An unauthenticated remote attacker can submit a forged token asserting an administrative identity to obtain unauthorized access and potentially take over administrative accounts. The CVSS v3.1 score is 10.0 for multi-tenant deployments and 9.8 for single-tenant deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through unauthorized administrative access and full account takeover. Attackers may access API definitions, backend endpoints, application credentials, consumer keys, and secrets; modify API configurations, routing, and access policies; and create unauthorized users. Compromise of the API-management platform can enable API traffic manipulation, exposure of sensitive data, persistent administrative access, service disruption, and potential lateral movement into connected services. In single-tenant deployments, the assessed impact remains within one security-authority boundary.
If you can’t patch tonight, do this now.
Until patching is complete, restrict access to affected management interfaces and protected APIs to trusted administrative networks; remove affected systems from service if exposure cannot be adequately restricted. No configuration setting is identified that disables the vulnerable behavior. Monitor for JWTs using unexpected or unsupported algorithms, successful authentication without a corresponding legitimate login, unauthorized administrator creation or privilege changes, and unexplained API configuration or credential access. Review authentication, administrative, and HTTP access logs for historical exploitation. Network restrictions and monitoring do not replace the vendor fixes.
Patch, then assume compromise.
Apply the applicable WSO2 fixed update level or a later supported update: API Manager 4.1.0 update 257, 4.2.0 update 197, 4.3.0 update 108, 4.4.0 update 72, 4.5.0 update 57, or 4.6.0 update 21; API Control Plane 4.5.0 update 58 or 4.6.0 update 22; Traffic Manager 4.5.0 update 56 or 4.6.0 update 21; Universal Gateway 4.5.0 update 57 or 4.6.0 update 21. Community deployments can apply the public fixes in the WSO2 Carbon API Management and Product APIM repositories. If applying fixes is not feasible, migrate to an unaffected supported release. Investigate possible historical compromise and rotate potentially exposed administrative credentials, consumer keys, application secrets, and backend credentials after securing the deployment.
2 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
86 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.