CVE-2026-5430

waiting for further signals

GHSA-j7vh-5w8q-4m4x ↗EUVD-2026-53822 ↗

no check availablenot proven exploitable

cve.orgpublic poc+51dkev+40d

WSO2 Universal Gateway >= 4.5.0, < 4.5.0.57; >= 4.6.0, < 4.6.0.21; >= 4.5.0, < 4.5.0.56; >= 4.5.0, < 4.5.0.58; >= 4.6.0, < 4.6.0.22; >= 4.1.0, < 4.1.0.257; >= 4.2.0, < 4.2.0.197; >= 4.3.0, < 4.3.0.108; >= 4.4.0, < 4.4.0.72; >= 9.20.74, < 9.20.74.401; >= 9.28.116, < 9.28.116.417; >= 9.29.120, < 9.29.120.236; >= 9.30.67, < 9.30.67.167; >= 9.31.86, < 9.31.86.158; >= 9.32.147, < 9.32.147.59

fixed in 4.5.0.57, 4.6.0.21, 4.5.0.56, 4.5.0.58, 4.6.0.22, 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 9.20.74.401, 9.28.116.417, 9.29.120.236, 9.30.67.167, 9.31.86.158, 9.32.147.59

CWE-347 Improper Verification of Cryptographic Signature

ETK-2026-506, permanent identifier

cvss10.0nvdCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

17d 01h 04msince last run

30mAI analysis

timeline

0 = cve.org publication

cve.org publicationtrigger signal +40dkev+40dpublic poc+51dwaiting for further signals+59d

+10d

+20d

+30d

description

WSO2 Universal Gateway, Traffic Manager, API Control Plane, API Manager, and the org.wso2.carbon.apimgt REST API utility are affected by JWT signing-algorithm validation that can accept an unapproved algorithm. An unauthenticated attacker may obtain unauthorized access, including possible administrative account access, when the affected JWT authentication mechanism is exposed.

mitigation

Upgrade Universal Gateway to 4.5.0.57 or 4.6.0.21; Traffic Manager to 4.5.0.56 or 4.6.0.21; API Control Plane to 4.5.0.58 or 4.6.0.22; and API Manager to 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57, or 4.6.0.21, as applicable. Upgrade org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util to 9.20.74.401, 9.28.116.417, 9.29.120.236, 9.30.67.167, 9.31.86.158, or 9.32.147.59 for the applicable version line.

fixed in 4.5.0.57, 4.6.0.21, 4.5.0.56, 4.5.0.58, 4.6.0.22, 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 9.20.74.401, 9.28.116.417, 9.29.120.236, 9.30.67.167, 9.31.86.158, 9.32.147.59

check

exploit

automation

contextual

auth required

EPSS

0.59%47th percentile

agent run time

30m

cve.org record, t = 0

2026-08-06 07:33Z

Δ to public poc

+51d

Δ to kev

+40d

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-08-06 07:33Z
cve.org record for CVE-2026-5430
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-5430
2026-09-15
vulncheck_kev: trigger signal, started the run
https://vulncheck.com/cve/CVE-2026-5430
2026-09-15 00:00Z
VulnCheck KEV
vulncheck_kev · https://vulncheck.com/cve/CVE-2026-5430
2026-09-24 00:00Z
CISA Known Exploited Vulnerabilities catalog
cisa_kev · https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430
2026-10-04 04:20Z
abraxas/CVE-2026-5430
github · https://github.com/abraxas/CVE-2026-5430

this entry in the feed

GET /api/v1/feed/CVE-2026-5430

{
  "etk_id": "ETK-2026-506",
  "cve_id": "CVE-2026-5430",
  "display_id": "CVE-2026-5430",
  "ghsa_id": "GHSA-j7vh-5w8q-4m4x",
  "euvd_id": "EUVD-2026-53822",
  "status": "published",
  "anchor_state": "anchored",
  "title": "JWT algorithm validation bypass in WSO2 API products",
  "summary": "WSO2 Universal Gateway, Traffic Manager, API Control Plane, API Manager, and the org.wso2.carbon.apimgt REST API utility are affected by JWT signing-algorithm validation that can accept an unapproved algorithm. An unauthenticated attacker may obtain unauthorized access, including possible administrative account access, when the affected JWT authentication mechanism is exposed.",
  "mitigation": "Upgrade Universal Gateway to 4.5.0.57 or 4.6.0.21; Traffic Manager to 4.5.0.56 or 4.6.0.21; API Control Plane to 4.5.0.58 or 4.6.0.22; and API Manager to 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57, or 4.6.0.21, as applicable. Upgrade org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util to 9.20.74.401, 9.28.116.417, 9.29.120.236, 9.30.67.167, 9.31.86.158, or 9.32.147.59 for the applicable version line.",
  "vendor": "WSO2",
  "product": "WSO2 Universal Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.57",
        ">= 4.6.0, < 4.6.0.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.57",
        "4.6.0.21"
      ],
      "package_name": "WSO2 Universal Gateway",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.56",
        ">= 4.6.0, < 4.6.0.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.56",
        "4.6.0.21"
      ],
      "package_name": "WSO2 Traffic Manager",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.58",
        ">= 4.6.0, < 4.6.0.22"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.58",
        "4.6.0.22"
      ],
      "package_name": "WSO2 API Control Plane",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.1.0, < 4.1.0.257",
        ">= 4.2.0, < 4.2.0.197",
        ">= 4.3.0, < 4.3.0.108",
        ">= 4.4.0, < 4.4.0.72",
        ">= 4.5.0, < 4.5.0.57",
        ">= 4.6.0, < 4.6.0.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.1.0.257",
        "4.2.0.197",
        "4.3.0.108",
        "4.4.0.72",
        "4.5.0.57",
        "4.6.0.21"
      ],
      "package_name": "WSO2 API Manager",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.20.74, < 9.20.74.401",
        ">= 9.28.116, < 9.28.116.417",
        ">= 9.29.120, < 9.29.120.236",
        ">= 9.30.67, < 9.30.67.167",
        ">= 9.31.86, < 9.31.86.158",
        ">= 9.32.147, < 9.32.147.59"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.20.74.401",
        "9.28.116.417",
        "9.29.120.236",
        "9.30.67.167",
        "9.31.86.158",
        "9.32.147.59"
      ],
      "package_name": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
      "purl": null
    }
  ],
  "cwes": [
    347
  ],
  "cvss_score": 10,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0059,
  "epss_percentile": 0.4716,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.19032645,
  "t0_at": "2026-08-06T07:33:28.156000+00:00",
  "signals": {
    "kev": {
      "at": "2026-09-15T00:00:00+00:00",
      "days": 40,
      "is_lower_bound": false,
      "measured_at": "2026-08-06T07:33:28.156000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-5430"
    },
    "public_poc": {
      "at": "2026-09-25T20:53:51+00:00",
      "days": 50.555819953703704,
      "is_lower_bound": false,
      "measured_at": "2026-08-06T07:33:28.156000+00:00",
      "url": "https://github.com/abraxas/CVE-2026-5430"
    },
    "trigger_signal": {
      "at": "2026-09-15T00:00:00+00:00",
      "days": 39.68509078703703,
      "is_lower_bound": false,
      "measured_at": "2026-08-06T07:33:28.156000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-5430"
    }
  }
}

published 2026-10-03 21:46Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.