Do Son 
TL;DR
WSO2 disclosed four critical vulnerabilities across its API and identity products. Several are WSO2 account takeover flaws. The worst, CVE-2026-5430, scores a maximum 10 through a JWT authentication bypass. Admins should apply the fixes right away.
- Product: WSO2 (3 products)
- Vulnerabilities: 4 flaws (CVE-2026-5430, CVE-2026-1728, CVE-2025-15039, CVE-2026-3418)
- Highest severity: 10.0 (Critical · CVSSv3)
- Worst impact: Authentication Bypass via JWT Algorithm Mismatch in Multiple Products Allows Account Takeover
- Status: 1 exploited; patches available
- Exploit Intel (PatchThis): 1 of 4 confirmed
- Action: Update to 4.5.0.57, 4.6.0.21, 4.5.0.56, 4.5.0.58 (+94) now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-5430 | 10 | CWE-347 | 4.5.0.57, 4.6.0.21, 4.5.0.56 (+13) | Exploited |
| CVE-2026-1728 | 9.8 | CWE-269 | 4.0.0.384, 4.1.0.248, 4.2.0.188 (+15) | Not exploited |
| CVE-2025-15039 | 9.4 | CWE-693 | 5.7.0.130, 5.8.0.113, 5.9.0.173 (+51) | Not exploited |
| CVE-2026-3418 | 9.1 | CWE-434 | 4.4.0.67, 4.5.0.52, 4.6.0.16 (+7) | Not exploited |
Why it matters
WSO2 products manage APIs and user identities for many enterprises. A takeover of an admin account exposes that whole stack. So these WSO2 account takeover flaws carry serious weight.
How the attacks work
Each flaw targets a different weak point. Three can lead to account takeover. One can lead to code execution.
Authentication bypass
CVE-2026-5430 scores 10 in multi-tenant setups. An attacker signs a JWT with an unsupported algorithm to bypass authentication. That can compromise admin accounts. The score drops to 9.8 in single-tenant deployments.
Privilege escalation
CVE-2026-1728 scores 9.8. A low-privileged user reuses their token against Admin REST APIs. As a result, they can reach full administrative control.
Adaptive authentication flaw
CVE-2025-15039 scores 9.4. Under a specific conditional authentication pattern, an attacker completes only the first login steps. That can grant access to a target account.
Arbitrary file upload
CVE-2026-3418 scores 9.1. An authenticated publisher uploads a file to a server-accessible path. Depending on the setup, that upload could lead to code execution. This report withholds working exploit steps.
Exploitation status
WSO2 has not reported any in-the-wild exploitation. No public proof-of-concept has been confirmed for these flaws.
Affected versions
The flaws span WSO2 API Manager, Identity Server, Universal Gateway, and more. Version ranges vary by CVE, so check each product carefully.
Patch and mitigation
Apply the public fixes now. WSO2 links each patch in its advisory. If patching is not feasible, migrate to the latest unaffected release. Full details appear in the WSO2 2026 security advisories.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
