CVE-2026-5430 is a CVSS 3.1 10.0 authentication flaw in WSO2 Multiple Products in which the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. An attacker can craft a JWT using an unsupported algorithm; the token is then validated incorrectly and accepted, resulting in unauthorised access that can extend to administrative accounts and full account takeover.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on 24 September 2026, making it one of two additions that day alongside Adobe Commerce CVE-2026-71362.
Details
The vulnerability is algorithm confusion in JWT verification: the relying party does not constrain the accepted signing algorithm to the configured set, so a token signed under a weaker or unexpected algorithm passes validation.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-5430 |
| CVSS | 10.0 (NVD, CVSS 3.1) — Critical |
| Vendor / product | WSO2 Multiple Products |
| Type | JWT algorithm confusion → authentication bypass, privilege escalation to administrator |
| User interaction | None required |
| Status | In CISA KEV as of 24 September 2026 (exploitation evidence) |
| Reported | 24 September 2026 (KEV addition) |
Catalogue label divergence. The CISA KEV entry is titled "WSO2 Multiple Products Path Traversal Vulnerability", while the NVD record describes algorithm confusion in JWT validation. The NVD description is used here as the authoritative account of the flaw; the KEV listing title should not be read as a separate path-traversal defect.
Mitigation
Constraining accepted JWT signing algorithms to the configured set is the direct fix; where a patched release is available it should be applied first. Because WSO2 API Manager and Identity Server are identity providers, a bypass here reaches every application federated to them, so credential rotation for administrative accounts and a review of authentication logs for tokens with unexpected alg values are the appropriate follow-up once exposure is confirmed. Australian organisations running WSO2 in a federated identity role should treat this as a priority review rather than a routine patch, given the KEV listing carries exploitation evidence rather than a score alone.