CVE-2026-5430 is a critical vulnerability in multiple WSO2 products caused by improper verification of JSON Web Token (JWT) signatures and algorithms (CWE-347), combined with a path traversal and unrestricted file upload weakness. A token using an unsupported algorithm can be accepted as valid, allowing an unauthenticated remote attacker to take over administrator accounts and potentially achieve remote code execution. CVSS score: 10.0 (Critical). WSO2 tracks it as WSO2-2026-5328.

The following WSO2 products are affected prior to the fixed builds:

WSO2 API Manager: before 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57 and 4.6.0.21 (per release train) – (Affected)
WSO2 API Control Plane: before 4.5.0.58 and 4.6.0.22 – (Affected)
WSO2 Traffic Manager: before 4.5.0.56 and 4.6.0.21 – (Affected)
WSO2 Universal Gateway: before 4.5.0.57 and 4.6.0.21 – (Affected)

Not affected / patched version:

The fixed builds listed above or later for each product and release train, as published in WSO2 security advisory WSO2-2026-5328 – (Not affected)

Successful exploitation may allow attackers to:

• Forge or manipulate JWTs to bypass authentication without valid credentials
• Take over administrator accounts on the API management platform
• Upload malicious files and achieve remote code execution, compromising APIs, backend services and the credentials they handle

CERTVU recommends the following:

1. Patch Immediately

   Update all affected WSO2 products to the fixed builds in advisory WSO2-2026-5328 as an emergency change.

2. Inventory and Restrict Exposure

3. Hunt for Compromise

4. Rotate Credentials and Secrets

   After patching, rotate administrator passwords, API keys, keystore secrets and any credentials stored on the platform.