The vulnerability identified as CVE-2026-5430 in WSO2 Universal Gateway (versions 4.5.0 and 4.6.0) involves improper validation of JWT tokens where tokens signed with algorithms not explicitly configured or supported are accepted. This weakness corresponds to CWE-347 (Improper Validation of Certificate With Host Mismatch) and results in the authentication mechanism incorrectly validating crafted JWTs, enabling attackers to gain unauthorized access. The CVSS 3.1 vector indicates a critical remote code execution or full system compromise potential within a single security boundary. No vendor advisory or patch information is currently provided, and the vulnerability is not known to be exploited in the wild.

Successful exploitation can lead to unauthorized access to the WSO2 Universal Gateway system, including compromise of administrative accounts and full account takeover. The impact affects confidentiality, integrity, and availability at a high level. The vulnerability is exploitable remotely without authentication or user interaction. The scope is within a single security authority boundary in single-tenant deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected WSO2 Universal Gateway instances and monitor for suspicious authentication attempts involving JWT tokens with unusual algorithms. Avoid deploying affected versions in exposed environments if possible.