Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access
WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.
WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.
- JWT authentication can be bypassed by supplying a token signed with an unsupported algorithm
- Affects API Control Plane, API Manager, Traffic Manager, and Universal Gateway versions 4.1.0-4.6.0
- CVSS 10.0 vector shows remote exploitation with no credentials or user interaction
- Compromise of the API control plane can expose managed APIs, policies, and backend services
- Fixes shipped via update levels, e.g. API Manager 4.6.0 update 21
- CVEs
- CVE-2026-5430
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
From the original article
2 min read at cybersecuritynews.com
WSO2 has disclosed a critical authentication bypass vulnerability that could allow remote attackers to take over accounts, including administrative accounts, in affected API management products. Tracked as CVE-2026-5430, the flaw has received a CVSS score of 10. 0 and requires no authentication or user interaction to exploit.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.