NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
CRITICAL severity

CVE-2026-5430 — Api Control Plane

CRITICAL

CVE-2026-5430 is a critical-severity (CVSS 10) CWE-347 vulnerability in wso2 api control plane. EPSS puts its 30-day exploitation probability at 22.4% (98th percentile). A fix is available — see the affected versions and patch details below.

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported…

Published
Updated
Affected
4 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • CISA’s SSVC triage classifies this CVE as under active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-5430.

EPSS Exploitation Probability

via FIRST.org ↗
22.4%probability of exploitation in next 30 days
Moderate Risk0.00%
Lower risk than most CVEs98th percentile — riskier than 98% of all scored CVEsHighest risk
0.00%9.64%19.3%28.9%0.6%22.4%22.4%Oct 26Nov 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Affected Products

4 products · 12 configurations
Application
api control planewso2
≥ 4.6.0 && < 4.6.0.22
range
Application
api managerwso2
≥ 4.6.0 && < 4.6.0.21
range
Application
traffic managerwso2
≥ 4.6.0 && < 4.6.0.21
range
Application
universal gatewaywso2
≥ 4.6.0 && < 4.6.0.21
range

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every wso2 api control plane deployment and check each version against the affected-products list above.

  2. Fix

    Apply the wso2 api control plane security patch or hotfix for CVE-2026-5430 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained w
O3 Security · Runtime Protection

Is CVE-2026-5430 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-5430: Api Control Plane (Critical 10, KEV)