What is CVE-2026-5430?

CVE-2026-5430 is an unauthenticated vulnerability affecting WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Manager Rest API Utility. The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then...

CVE-2026-5430 Exploitation Attempts Observed in the Wild — WSO2

Q: Who is affected?

CVE-2026-5430 affects WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Manager Rest API Utility. Previdian lists 19 version rows; examples include 4.5.0 to < 4.5.0.57, 4.6.0 to < 4.6.0.21, and 4.5.0 to < 4.5.0.56.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-5430 is an unauthenticated vulnerability affecting WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Manager Rest API Utility.

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Affected products include WSO2 Universal Gateway and 4 other products, including affected before 4.5.0.57, affected before 4.6.0.21, and affected before 4.5.0.56.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

WSO2 Universal Gateway Authentication Bypass Authentication Bypass

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Vendor Product Affected Status

WSO2 Affected

WSO2 Universal Gateway

Before 4.5.0.57 Before 4.6.0.21

Affected

WSO2 Affected

WSO2 Traffic Manager

Before 4.5.0.56 Before 4.6.0.21

Affected

WSO2 Affected

WSO2 API Control Plane

Before 4.5.0.58 Before 4.6.0.22

Affected

WSO2 Affected

WSO2 API Manager

Before 4.1.0.257 Before 4.2.0.197 Before 4.3.0.108 Before 4.4.0.72 Before 4.5.0.57 Before 4.6.0.21

Affected

WSO2 Affected

WSO2 Carbon API Manager Rest API Utility org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

Before 9.20.74.401 Before 9.28.116.417 Before 9.29.120.236 Before 9.30.67.167 Before 9.31.86.158 Before 9.32.147.59

Affected

WSO2 Unaffected

WSO2 Carbon API Manager Rest API Utility org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

Through *

Unaffected

View vendor advisory

Published: 06 Aug 2026
Exploitation Attempts Reported: 16 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-5430
Vendor Advisory — security.docs.wso2.com security.docs.wso2.com · Vendor Advisory https://security.docs.wso2.com/en/latest/security-announcements/secur...

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

The Hacker News

Recorded 16 Sep 2026

A trusted third party reported exploitation attempts.

Proof of concept available

GitHub

Recorded 25 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
The Hacker News First	2026-09-16 05:18 UTC
CISA	2026-09-24 19:20 UTC
CVE	2026-09-24 19:50 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

10.0 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

22.4%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Verification of Cryptographic Signature CWE-347

Recent mention · Security Affairs

25 Sep 2026

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities...

Read full advisory

All Mentions

Recent mention · Security Affairs

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

Security Affairs · 25 Sep 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products […]

Recent mention · The Hacker News

WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

The Hacker News · 25 Sep 2026

Ravie LakshmananSep 25, 2026Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution. CVE-2026-71362 (CVSS...

Recent mention · The Hacker News

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

The Hacker News · 16 Sep 2026

A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw. "JWT authentication

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

davidvrns/CVE-2026-5430-WSO2

github · Created 2026-10-08 00:42:07 UTC · 0 stars · AI assessment 90%

Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.

abraxas/CVE-2026-5430

github · Created 2026-09-25 20:53:51 UTC · 0 stars · AI assessment 85%

CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway

Timeline

From disclosure to observed exploitation attempts

25 Sep 2026
20:53 UTC

Public PoC available

Public proof-of-concept code published
24 Sep 2026
19:50 UTC

KEV confirmed by CVE

Exploitation attempts reported by an external source
24 Sep 2026
19:20 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
16 Sep 2026
05:18 UTC

Added to Previdian KEV Feed

High-confidence, third-party report of exploitation attempts
13 Aug 2026
00:00 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 1 month of early warning before CISA KEV. Also 1 month before Previdian KEV.
06 Aug 2026
07:33 UTC

CVE published

Vulnerability disclosed publicly
02 Apr 2026
16:11 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-5430

Sample API response

{
  "cve_id": "CVE-2026-5430",
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "cvss_estimated": false,
  "epss_score": 0.2239,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-5430

WSO2 Universal Gateway Authentication Bypass Authentication Bypass

Tags

CVE References

Exploitation Attempts Observed in the Wild

Proof of concept available

Known exploited vulnerability sources

Scanner coverage

Virtual patch status

Weaknesses

U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

All Mentions

Potential Proof of Concepts

Public PoC available

KEV confirmed by CVE

Added to CISA KEV

Added to Previdian KEV Feed

Added to the Previdian watchlist

CVE published

CVE ID reserved

Automate this intelligence