CVE-2026-5430

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 WSO2 API Control Plane versions 4.5.0 through 4.6.0 WSO2 Traffic Manager versions 4.5.0 through 4.6.0 WSO2 Universal Gateway versions 4.5.0 through 4.6.0

Description The JWT authentication mechanism incorrectly validates tokens signed with algorithms other than those explicitly configured or supported. This occurs because the OAuthAuthenticationInterceptor fails to properly handle exceptions thrown by JWTUtil.verifyTokenSignature() when an unsupported algorithm is used, allowing the request to proceed instead of being rejected. An attacker can exploit this by crafting a JWT using an unsupported algorithm (such as HS256 when the server expects RSA), leading to an authentication bypass. This can result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. Active exploitation has been confirmed, with attackers using forged administrative claims to target management REST APIs on port 9443, specifically endpoints such as /api/am/admin/ and /api/am/publisher/.

Recommendations Update WSO2 API Manager 4.1.0 to update level 257 (4.1.0.257) or later. Update WSO2 API Manager 4.2.0 to update level 197 (4.2.0.197) or later. Update WSO2 API Manager 4.3.0 to update level 108 (4.3.0.108) or later. Update WSO2 API Manager 4.4.0 to update level 72 (4.4.0.72) or later. Update WSO2 API Manager 4.5.0 to update level 57 (4.5.0.57) or later. Update WSO2 API Manager 4.6.0 to update level 21 (4.6.0.21) or later. Update WSO2 API Control Plane 4.5.0 to update level 58 (4.5.0.58) or later. Update WSO2 API Control Plane 4.6.0 to update level 22 (4.6.0.22) or later. Update WSO2 Traffic Manager 4.5.0 to update level 56 (4.5.0.56) or later. Update WSO2 Traffic Manager 4.6.0 to update level 21 (4.6.0.21) or later. Update WSO2 Universal Gateway 4.5.0 to update level 57 (4.5.0.57) or later. Update WSO2 Universal Gateway 4.6.0 to update level 21 (4.6.0.21) or later. As a temporary mitigation, isolate port 9443 or restrict access to the management REST API endpoints to trusted networks. Revoke sessions and rotate exposed credentials if a compromise is suspected.