Multiple security vulnerabilities have been identified in WSO2 products that could allow attackers to bypass authentication and authorization controls, escalate privileges, or compromise user accounts and administrative interfaces.
• CVE-2026-5430 – A JWT authentication bypass vulnerability could allow attackers to bypass authentication using a token signed with an unsupported algorithm, potentially resulting in account takeover.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in WSO2 products that could allow attackers to bypass authentication and authorization controls, escalate privileges, or compromise user accounts and administrative interfaces.
• CVE-2026-5430 – A JWT authentication bypass vulnerability could allow attackers to bypass authentication using a token signed with an unsupported algorithm, potentially resulting in account takeover.[emaillocker id="1283"]
• CVE-2026-1728 – A privilege escalation vulnerability allows low-privileged users to access product-level Admin REST APIs, potentially leading to administrative account takeover.
• CVE-2025-15039 – A security vulnerability in WSO2 products could allow unauthorized access or privilege escalation under specific deployment configurations.
• CVE-2026-3418 – A vulnerability affecting WSO2 products could allow unauthorized access or compromise of protected functionality.
Successful exploitation of these vulnerabilities could result in account takeover, privilege escalation, unauthorized administrative access, and compromise of API and identity-management infrastructure. Organizations using affected WSO2 products should apply the latest vendor security updates and upgrade to supported, unaffected versions.
We recommend you to update WSO2 to version 4.5.0.57.
The following reports contain further technical details:
[/emaillocker]