What is the CVSS score of CVE-2026-5430?

CVE-2026-5430 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WSO2 API Manager are affected by CVE-2026-5430?

WSO2 API Manager contains a critical authentication bypass vulnerability (CVSS 10.0) that allows unauthenticated remote attackers to forge JWT tokens and achieve administrative account takeover.. A patch is available.

How to fix or mitigate CVE-2026-5430?

Within 24 hours: Immediately inventory all WSO2 API Manager instances and versions in your environment, verify network exposure, and enable comprehensive audit logging on all authentication and token validation events. Within 7 days: Implement network segmentation restricting API Manager administrative console access to trusted networks only, deploy Web Application Firewall rules to detect and block JWT manipulation attempts, and disable any configurable support for non-standard JWT signing algorithms. Within 30 days: Contact WSO2 for emergency patch availability and timeline, plan immediate deployment to all affected versions when released, or evaluate emergency migration to alternative API management platforms if patching timeline is unacceptable.

WSO2 API Manager CVE-2026-5430

EUVD-2026-53822 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-06 WSO2

GHSA-j7vh-5w8q-4m4x

Authentication Bypass Jwt Attack Wso2 Api Manager Wso2 Universal Gateway Wso2 Traffic Manager Wso2 Api Control Plane Wso2 Carbon Api Manager Rest Api Utility Wso2

10.0

CVSS 3.1 · Vendor: WSO2

Severity by source

Vendor (WSO2) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity token forgery with total impact; I assess S:U (9.8) as the defensible base since impact stays within the gateway's authority, while multi-tenant setups justify the vendor's S:C 10.0.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WSO2).

CVSS VectorVendor: WSO2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 09:01 EUVD

Analysis Generated

Aug 06, 2026 - 08:33 vuln.today

CVE Published

Aug 06, 2026 - 07:33 cve.org

CRITICAL 10.0

DescriptionCVE.org

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

AnalysisAI

Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.

Technical ContextAI

The flaw is a JWT signature-verification weakness classified as CWE-347 (Improper Verification of Cryptographic Signature). JWTs carry an 'alg' header that dictates how the signature is checked; a secure verifier must pin verification to an explicit allowlist of algorithms and keys. Here the WSO2 authentication mechanism honors algorithms other than those configured/supported, meaning an attacker can select an algorithm the server should reject but instead processes - the classic JWT algorithm-confusion pattern (e.g., 'none', or substituting symmetric HMAC verification using a public key as the secret, or otherwise coercing weak/unintended verification). The affected CPEs are wso2:wso2_api_manager, wso2:wso2_universal_gateway, wso2:wso2_traffic_manager, wso2:wso2_api_control_plane, and wso2:wso2_carbon_api_manager_rest_api_utility - the API gateway/management stack that sits at the front door of API traffic and enforces token-based authentication for northbound and management APIs.

RemediationAI

Apply the fix described in the WSO2 security advisory WSO2-2026-5328 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/) for each deployed component - the provided data does not include a specific patched version string, so this is a patch-available-per-vendor-advisory situation and operators should install the exact update level (WUM/product update) WSO2 specifies for their release train rather than an invented version number. As compensating controls until patched, restrict network exposure of the gateway management and admin REST APIs to trusted networks or a bastion (reducing the reachable attack surface for administrative takeover, at the cost of remote-admin convenience), and where feasible enforce JWT validation policy that pins the accepted signing algorithm(s) and keys at an upstream proxy/WAF so tokens with unexpected 'alg' values are rejected before reaching WSO2 (this only helps if the proxy itself validates strictly and may break legitimate integrations relying on multiple algorithms). Also rotate any signing keys and audit recent authentications for anomalous tokens, since a forged-token bypass may not appear as a failed login.