CVE-2026-5430 affects WSO2 products through a flaw in JWT authentication. The JWT mechanism accepts tokens signed with algorithms other than those explicitly configured or supported, and an attacker can therefore craft a token using an unsupported algorithm that is then incorrectly validated. NVD scores it 10.0 with a changed-scope vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and notes that the score is adjusted to 9.8 in single-tenant deployments where the impact stays inside one security authority boundary. CISA added it to the Known Exploited Vulnerabilities catalog on 24 September 2026.

Algorithm confusion, described plainly

A JWT carries a header that names the signing algorithm, a payload, and a signature. Verification is supposed to ignore the attacker's claim about the algorithm and use the algorithm the verifier expects. When the implementation trusts the header instead, an attacker can present a token signed with something the verifier will accept but that the attacker can compute.
The family is well documented and has appeared in multiple libraries over the years. What makes this instance notable is where it landed: an identity and access management product. The token is not protecting a single application programming interface. It is the artefact that carries identity across everything the server protects.

Why the score is 10.0 and 9.8 at the same time

The changed-scope vector reflects a claim that a compromised component affects resources beyond its own security authority. In a multi-tenant identity deployment that is easy to justify: the token issuer is the trust anchor for every tenant that relies on it.
NVD's note that the score drops to 9.8 in single-tenant deployments is a useful honesty rather than a discount. A 9.8 remains critical. The note simply tells you that the blast radius depends on how many separate authorities answer to the same issuer.

What an attacker gets

Unauthorised access, including compromise of administrative accounts and full account takeover, is the language in the record. Read that as two separate problems. The first is direct: a token the attacker forged is accepted as a valid session for whichever subject it names, and if the attacker knows or can guess an administrative subject identifier, that is an administrative session without a password.
The second is quieter. Identity servers are where applications ask whether a token is still valid and what it authorises. An attacker who can mint tokens can also probe the authorisation model: which audiences are accepted, which scopes are implied, which downstream services trust the issuer without checking the audience. Those probes produce no failed logins.

Detection that does not depend on signatures

Signature verification failures are the obvious signal, and this vulnerability will not produce them when the attacker's token is accepted. What may appear is a mismatch between the token header and the configured algorithm. If your gateway or application logs the alg header at all, compare it against the expected value.
The stronger signal is behavioural. A session that was created without an authentication event, a token used for an audience it was never issued for, or a burst of administrative operations from a token whose subject never logged in through the usual flow. Identity server audit logs are the place to look, and they are usually retained longer than web server logs.

Remediation

Apply the vendor fix. WSO2 publishes security advisories with the specific product versions and the fixed releases for CVE-2026-5430, and that document is the authoritative source for what to install.
After the upgrade, verify that the configured algorithm list is explicit rather than permissive. A patched library that is configured to accept "any supported algorithm" reproduces part of the problem by policy. The configuration should name the algorithms in use and reject everything else.
Then rotate signing keys. If the vulnerable validator would accept a token signed with a key the attacker knows or can compute, the current key material cannot be assumed uncompromised. Rotation invalidates existing sessions, which is a business decision that should be taken deliberately rather than during an incident.

The wider point about identity

Identity servers concentrate trust, so they concentrate consequences. Every design simplification that makes them easier to operate, from a permissive algorithm list to a token format that carries authorisation decisions, increases the value of a single validation bug.
CVE-2026-5430 is a library defect with a vendor fix and a KEV entry. The part that remains with the operator is the algorithm allow-list, the audience checks in downstream services, and whether the identity logs are good enough to notice a session that was never authenticated.

References

  • WSO2 security advisory WSO2-2026-5328, https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

  • NIST NVD record for CVE-2026-5430, https://nvd.nist.gov/vuln/detail/CVE-2026-5430

  • CISA Known Exploited Vulnerabilities catalog entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430