# CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability 

- Exploited (CISA KEV): yes, added 2026-09-24
- Published: 2026-08-06
- CVSS: 10 CRITICAL (v3.1)
- EPSS: 22.4% (98th percentile)
- CWE: CWE-347

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-10-21 | 76 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-10-21 · new · rule 200013231
  > Added: signature 200013231 "WSO2 API Manager Authentication Bypass (2)" (Authentication/Authorization Attacks, risk High), systems: Java Servlets/JSP. References: CVE-2026-5430.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-5430 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-5430