CVE-2026-5430
| Affected software | 4 products, listed below |
|---|---|
| Severity | 10.0 Critical CVSS 3.1 |
| Weakness | CWE-347 |
| Published | 6 Aug 2026 |
| Updated | 25 Sep 2026 |
Description
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2026-09-24 · remediation due 2026-09-27 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 3 citations · 3 exploits · earliest 2026-09-15.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 4 indexed, none at 5+ stars
- EPSS 22% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2026-5430 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | x.com | /inkmoro/status/2099925214339727646 | 2026-09-15 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2026-09-24 |
| Reported exploitation | asec.ahnlab.com | /en/95741 | 2026-10-07 |
| Exploit reference | VulnCheck XDB 331d5cf317af | Exploit type: initial-access | 2026-09-25 |
| Exploit reference | VulnCheck XDB 4af342cce92b | Exploit type: initial-access | 2026-10-08 |
| Exploit reference | VulnCheck XDB 638349da3aad | Exploit type: initial-access | 2026-10-08 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection unknown
- Action not assessed
- Review automated Upstream data
- Record active
| Decided by | Somebody exploiting this CVE (a CISA or VulnCheck KEV listing, or a CISA verdict of active exploitation), with no fix, source code or PoC to build a rule from |
|---|---|
| Finding | CISA KEV lists this CVE as exploited in the wild (added 2026-09-24). VRT found no upstream fix and no open-source Maven package, and the published PoCs have fewer than 5 GitHub stars, so there is nothing to build an ARMR rule from yet. No rule exists and none is planned. Nobody has checked whether an existing ARMR rule already blocks it. |
Affected software and releases
Products and versions
4 products, 12 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | wso2 | api control plane | generic | ≥ 4.5.0 and ＜ 4.5.0.58 · ≥ 4.6.0 and ＜ 4.6.0.22 |
| nvd | wso2 | api manager | generic | ≥ 4.1.0 and ＜ 4.1.0.257 · ≥ 4.2.0 and ＜ 4.2.0.197 · ≥ 4.3.0 and ＜ 4.3.0.108 · ≥ 4.4.0 and ＜ 4.4.0.72 · ≥ 4.5.0 and ＜ 4.5.0.57 · ≥ 4.6.0 and ＜ 4.6.0.21 |
| nvd | wso2 | traffic manager | generic | ≥ 4.5.0 and ＜ 4.5.0.56 · ≥ 4.6.0 and ＜ 4.6.0.21 |
| nvd | wso2 | universal gateway | generic | ≥ 4.5.0 and ＜ 4.5.0.57 · ≥ 4.6.0 and ＜ 4.6.0.21 |
References
Timeline
Timeline
| Published | 2026-08-06 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2026-09-15 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2026-09-24 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-09-25 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-10-08 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |