CVE-2026-5430Published
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
cve-program · CVE-2026-5430
PublishedWSO2 Universal Gateway
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Universal Gateway",
"versions": [
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.57",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.0",
"lessThan": "4.6.0.21",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Traffic Manager
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Traffic Manager",
"versions": [
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.56",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.0",
"lessThan": "4.6.0.21",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 API Control Plane
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"versions": [
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.58",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.0",
"lessThan": "4.6.0.22",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 API Manager
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "4.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.257",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.197",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.108",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.4.0",
"lessThan": "4.4.0.72",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.57",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.0",
"lessThan": "4.6.0.21",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon API Manager Rest API Utility",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
"versions": [
{
"status": "affected",
"version": "9.20.74",
"lessThan": "9.20.74.401",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.28.116",
"lessThan": "9.28.116.417",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.29.120",
"lessThan": "9.29.120.236",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.30.67",
"lessThan": "9.30.67.167",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.31.86",
"lessThan": "9.31.86.158",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.32.147",
"lessThan": "9.32.147.59",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.33.106",
"lessThanOrEqual": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}Original source record · Cite this exact observation · Complete original publisher JSON