CVE-2026-5430: the JWT validator that skipped signature checking when it met an algorithm it did not know

A patched authentication bypass is easier to ignore than an unpatched one. WSO2 fixed CVE-2026-5430 in April 2026, published an advisory in May, and saw exploitation in the wild in September after CISA added it to the KEV catalog. The flaw, a CVSS 10.0 path traversal in the API Manager's authentication path, shows what a fail-open decision in a token validator costs once it sits in front of an API gateway.

What the flaw is

WSO2 API Manager has a flaw rated CVSS 10.0 in multi-tenant deployments and 9.8 in single-tenant deployments. Reporting frames it as a path traversal, and the exploited behaviour observed in the wild is an authentication bypass that leads to account takeover. An unauthenticated attacker can reach administrative functions without a valid credential.

Where the trust decision is made

The product sits in the request path in front of internal APIs. Its job is to authenticate the caller and then forward the request, which means it holds the identity decision for every backend it fronts. When that decision is wrong, every downstream control still runs, but it runs on a subject the attacker chose.

Why this instance is a credential event and not just a bypass

Administrative access to an API manager is not the same as shell access to one server. The platform stores the consumer keys and secrets of every registered application, and it holds the routing and policy configuration that decides which internal service a request reaches. Recovering from that access means rotating credentials for every external integration, not restarting a service.

The patch gap is the real finding

The fix existed for roughly five months before exploitation was observed. The gap was not caused by the vulnerability becoming harder to exploit; it was caused by organisations not tracking the update level. WSO2 ships fixes as update levels within a release line, so a team that recorded only the major version had no way to see that it was exposed.

What to do

Upgrade to a fixed update level for the affected products, including WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway. If exposure is suspected, treat it as a credential compromise: rotate consumer keys and secrets, review administrative accounts, and check logs for administrative API calls that do not correspond to known integrations.
The durable fix is to record update levels rather than marketing versions in the asset inventory. A patch that exists and is not applied is a scheduling problem, and scheduling problems do not show up in a vulnerability scan that only reads version strings.

References

• Fnet cloud security briefing, 17 September 2026, https://blog.csdn.net/Fnetlink1/article/details/165717754
• SecureMyMind analysis of CVE-2026-5430, https://blog.securemymind.com/
• Daily security intelligence report, 1 October 2026, https://blog.csdn.net/weixin_45635831/article/details/166945207