CVE-2026-14916

Name of the Vulnerable Software and Affected Versions Kong API Gateway Enterprise (affected versions not specified)

Description A JWT signature verification issue exists in Kong components that handle JWT validation for MCP OAuth2 or DataKit integrations. The system fails to properly validate whether the JWT signing algorithm is compatible with the key type used for verification. This allows an unauthenticated remote attacker to create a forged JWT that the system accepts as valid, resulting in an authentication bypass and potential compromise of confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.