CVE-2026-5430: the JWT validator that skipped signature checking when it met an algorithm it did not know
CVE-2026-5430: the JWT validator that skipped signature checking when it met an algorithm it did not know A patched authentication bypass is easier to ignore than an unpatched one. WSO2 fixed CVE-2026-5430 in April 2026, published an advisory in May, and saw exploitation in the wild in September after CISA added it to the KEV catalog. The flaw, a CVSS 10.0 path traversal in the API Manager's authentication path, shows what a fail-open decision in a token validator costs once it sits in front of…