The vulnerability identified as CVE-2026-5430 in WSO2 Universal Gateway versions 4.5.0 and 4.6.0 involves improper validation of JWT tokens where the authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This weakness (CWE-347) allows an attacker to craft a JWT using an unsupported algorithm that is incorrectly validated by the system, resulting in unauthorized access. The vulnerability is critical with a CVSS 3.1 score of 10.0, reflecting network exploitability without privileges or user interaction and full compromise of confidentiality, integrity, and availability. The impact is scoped to a single security authority boundary in single-tenant environments. No vendor-provided patch or remediation details are currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to the WSO2 Universal Gateway system, including potential compromise of administrative accounts and full account takeover. The vulnerability allows bypassing JWT algorithm validation, undermining authentication controls. The CVSS score of 10.0 indicates critical impact with complete loss of confidentiality, integrity, and availability. The impact is limited to the security boundary of a single tenant deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider additional compensating controls such as restricting access to the affected service, monitoring for suspicious authentication activity, and validating JWT tokens externally if feasible. Avoid relying solely on the vulnerable JWT authentication mechanism for critical access control.