CVE-2026-5430
CISA 기관 조치 기한: 2026-09-27
WSO2 Multiple Products
Qualys 위협 인텔 · 심각도 4/5 · QID 735688 · CGI
공개 익스플로잇
측면이동
쉬운 악용
대량 데이터 유출
서비스 거부
웜 전파
권한상승
인증 불필요
CISA KEV
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
KEV 필수 조치: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
타임라인
- NVD 공개
- 첫 보도 The Hacker News · 위조된 관리자 토큰을 이용한 WSO2 API Manager의 JWT 우회 취…
- CISA KEV 등재(실제 악용 확인) 공개 후 49일
- CISA 기관 조치 기한 경과
- 최근 보도 (총 4건) 안랩 ASEC · 2026년 3분기 취약점 동향보고서
날짜 정보 없는 신호: 공개 PoC 4건 웜 전파
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
공개 익스플로잇 / PoC
- GitHub 공개 PoC 4건 — 대표 레포 ↗