On 24 September 2026 CISA added CVE-2026-5430 to the KEV catalog with a due date of 27 September. The flaw is in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. WSO2 had published its advisory, WSO2-2026-5328, on 3 May 2026, so organizations had almost five months to patch before CISA recorded exploitation.
One thing to know when you read the KEV entry. Its short description talks about path traversal, file upload and remote code execution. The WSO2 advisory and NVD describe a different bug: a JWT authentication bypass. The advisory is the one to follow, and the KEV entry itself links to it and lists CWE-347.
What's affected
WSO2 describes the bug this way: JWT authentication can be bypassed when a token is signed with an unsupported algorithm, allowing unauthorized access. It may lead to compromise of administrative accounts and full account takeover.
- CVSS: 10.0 (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reduced to 9.8 for single tenant deployments where the impact stays inside one authority boundary. - Affected versions: API Control Plane 4.6.0 and 4.5.0. API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0 and 4.1.0. Traffic Manager 4.6.0 and 4.5.0. Universal Gateway 4.6.0 and 4.5.0.
- Credit: reported by the Hacktron team.
Fixes for subscribers, as minimum update levels:
| Product | Version | Update level |
|---|---|---|
| API Manager | 4.6.0 / 4.5.0 / 4.4.0 | 21 / 57 / 72 |
| API Manager | 4.3.0 / 4.2.0 / 4.1.0 | 108 / 197 / 257 |
| API Control Plane | 4.6.0 / 4.5.0 | 22 / 58 |
| Traffic Manager | 4.6.0 / 4.5.0 | 21 / 56 |
| Universal Gateway | 4.6.0 / 4.5.0 | 21 / 57 |
Community users can apply the public fixes in carbon-apimgt pull request 13752 and product-apim pull request 14167, or move to the latest unaffected version. WSO2 lists no workarounds.
How to check if you're exposed
On each WSO2 host, find the product and its update level. For subscribers, the WSO2 Updates tool reports the current level against the table above. For community installs, check the product version in the distribution name and confirm whether the two pull requests are in your build.
Also look at where the gateway and admin endpoints are reachable. Any publisher, admin or gateway endpoint exposed to the internet deserves attention first. The advisory offers no detection guidance, so review authentication logs for admin sessions you cannot tie to a person, and check for new users or API keys created recently.
What to do now
- Inventory every WSO2 API product, including gateways in each region and any bundled in other platforms.
- Update to the levels in the table, or take the public fixes if you run the community edition.
- Restrict management and admin endpoints to trusted networks while you patch.
- Because the entry carries the forensic triage flag, review admin accounts, API subscriptions and application credentials for changes since early May.
- Rotate secrets stored in the platform if you find signs of takeover.
Why it matters
JWT algorithm handling is a recurring weak point. A verifier that accepts tokens signed with algorithms it was not configured to use hands the choice to the attacker. The standard defense is to pin the allowed algorithms in code and reject everything else.
The timeline is the other lesson. A critical advisory in May, an NVD entry in August and a KEV listing in late September means the exploited window could have been long. Do not wait for KEV before you act on a critical bug in an exposed API gateway.
Try it yourself
Pick one API gateway you run and write down which JWT algorithms it is configured to accept. If you cannot find the setting in a minute, nobody on the team really knows what it accepts.
Click through it at your own pace, or open it full screen.
Quick check
Which WSO2 API Manager versions are affected?
4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0 and 4.1.0, per advisory WSO2-2026-5328.
Why does the KEV text differ from the WSO2 advisory?
The KEV short description mentions path traversal and file upload, while WSO2 and NVD describe a JWT algorithm bypass. Follow the vendor advisory for the fix.
