The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a J…

CVE-2026-5430 describes a critical vulnerability in a JWT authentication mechanism that incorrectly accepts tokens signed with unsupported or unconfigured algorithms. An attacker can craft a malicious JWT using an unsupported algorithm that bypasses validation, leading to unauthorized system access. Successful exploitation can result in full account takeover, including compromise of administrative accounts. The vulnerability carries a CVSS score of 9.8 (Critical) under CVSS:3.1, with network-based attack vector, low complexity, and no privileges or user interaction required. The high scores across confidentiality, integrity, and availability reflect the severity of potential impact. The score specifically applies to single-tenant deployments where the impact is contained within one security boundary. WSO2 has published a security advisory (WSO2-2026-5328) addressing this issue. Organizations using affected WSO2 products should apply patches or mitigations immediately given the critical nature of this authentication bypass.