JWT algorithm validation bypass enables account takeover in WSO2 API Manager and related products

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

• WSO2 Universal Gateway: 4.5.0, less than 4.5.0.57; 4.6.0, less than 4.6.0.21. The product default status is unaffected outside the listed ranges.
• WSO2 Traffic Manager: 4.5.0, less than 4.5.0.56; 4.6.0, less than 4.6.0.21. The product default status is unaffected outside the listed ranges.
• WSO2 API Control Plane: 4.5.0, less than 4.5.0.58; 4.6.0, less than 4.6.0.22. The product default status is unaffected outside the listed ranges.
• WSO2 API Manager: 4.1.0, less than 4.1.0.257; 4.2.0, less than 4.2.0.197; 4.3.0, less than 4.3.0.108; 4.4.0, less than 4.4.0.72; 4.5.0, less than 4.5.0.57; 4.6.0, less than 4.6.0.21. The product default status is unaffected outside the listed ranges.
• WSO2 Carbon API Manager Rest API Utility, package org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util: 9.20.74, less than 9.20.74.401; 9.28.116, less than 9.28.116.417; 9.29.120, less than 9.29.120.236; 9.30.67, less than 9.30.67.167; 9.31.86, less than 9.31.86.158; 9.32.147, less than 9.32.147.59. The default status of this package is unknown.

Branches or statuses not listed in the record are not confirmed unaffected.

The flaw is in the JWT authentication mechanism used by the affected WSO2 products. An attacker can craft a JWT using a signing algorithm that is not explicitly configured or supported, but the mechanism nevertheless accepts and incorrectly validates the token. The result is an authentication bypass that can grant unauthorized access. The record supports network reachability, no required prior privileges, low attack complexity, and no user interaction, but it does not identify a specific endpoint or token field. The exact implementation defect, such as the validation library behavior or algorithm-selection code, is not documented in the available evidence. The supplied record maps the issue to CWE-347, while the concrete advisory description is acceptance of an unsupported algorithm during JWT validation.

The vulnerability can be reached remotely over the network through an accessible JWT-authenticated flow. The supplied exploitability attributes indicate that exploitation requires no prior authentication, has low complexity, and requires no user interaction. The normalized record marks the vulnerability as known exploited and as having a public exploit. It does not name a campaign, victim, malware family, or specific indicator. That status alone does not establish that a particular organization or installation has been compromised.

The flaw bypasses JWT authentication and can turn an unauthenticated request into an unauthorized session. Reported consequences include potential compromise of administrative accounts and full account takeover, so the permissions of the impersonated account may determine the affected resource scope. Potential outcomes include loss of data confidentiality, unauthorized changes to data or configuration, and service disruption. The record describes changed scope in the general assessment, while single-tenant deployments are described as contained within one security authority boundary. The specific endpoint, business flow, and cross-tenant behavior for each configuration remain unknown.

Successful exploitation may provide unauthorized access to a WSO2 system, including potential compromise of administrative accounts and full account takeover. Depending on the impersonated account's permissions, consequences may include access to data, changes to API resources or configuration, and disruption of service operations. The supplied impact assessment indicates serious consequences for confidentiality, integrity, and availability. In single-tenant deployments, the advisory describes the impact as contained within one security authority boundary; the record does not confirm compromise of a named organization or system.

1. Prioritize updates for the affected WSO2 products using the corresponding update level for each branch:

• WSO2 API Control Plane: 4.5.0 update level 58; 4.6.0 update level 22.
• WSO2 API Manager: 4.1.0 update level 257; 4.2.0 update level 197; 4.3.0 update level 108; 4.4.0 update level 72; 4.5.0 update level 57; 4.6.0 update level 21.
• WSO2 Traffic Manager: 4.5.0 update level 56; 4.6.0 update level 21.
• WSO2 Universal Gateway: 4.5.0 update level 57; 4.6.0 update level 21.

1. Community or Open Source users should apply the corresponding public WSO2 fixes for the deployed product. If applying the fix or update is not feasible, migrate to an unaffected version according to WSO2's guidance.
2. For org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util, move the package outside the affected ranges using the corresponding boundary release: 9.20.74.401, 9.28.116.417, 9.29.120.236, 9.30.67.167, 9.31.86.158, or 9.32.147.59, as applicable to the deployed branch. Because the vendor advisory does not list this package separately in its update-level table, confirm the artifact and compatibility with WSO2 before deployment.
3. After updating, verify in a controlled environment that JWT validation accepts only configured or supported algorithms, then review access and account activity from the period in which the installation was exposed.

1. Inventory deployments of WSO2 API Manager, WSO2 API Control Plane, WSO2 Traffic Manager, WSO2 Universal Gateway, and the org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util package, then compare the installed version or update level with the ranges in affected_summary.
2. Review JWT authentication configuration and validation logic to confirm that only explicitly configured and supported algorithms are accepted.
3. If authentication or audit logs record JWT algorithms, review for tokens using unexpected algorithms or algorithms outside the configured allow-list. This is a precautionary review, not a vendor-confirmed indicator.
4. Review for anomalous sessions, administrative account changes, and unexplained administrative activity while an installation remained within an affected range.
5. After updating, perform a controlled validation that tokens using unsupported algorithms are rejected. The record does not provide a product-specific log event or indicator of compromise.