CVE-2026-5430Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leadin…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 4.5 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Sep 27, 2026
0.4%
Last analysed / modified upstream
0.4% → 22%
4 GitHub repos (last check)
Added to the CISA catalog on Sep 24, 2026. Federal remediation due Sep 27, 2026. View catalog ↗
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
api_control_plane >= 4.5.0, < 4.5.0.58api_control_plane >= 4.6.0, < 4.6.0.22api_manager >= 4.1.0, < 4.1.0.257api_manager >= 4.2.0, < 4.2.0.197api_manager >= 4.3.0, < 4.3.0.108api_manager >= 4.4.0, < 4.4.0.72api_manager >= 4.5.0, < 4.5.0.57api_manager >= 4.6.0, < 4.6.0.21traffic_manager >= 4.5.0, < 4.5.0.56traffic_manager >= 4.6.0, < 4.6.0.21universal_gateway >= 4.5.0, < 4.5.0.57universal_gateway >= 4.6.0, < 4.6.0.21Upgrade past the affected range:
api_control_plane 4.6.0.22api_manager 4.6.0.21traffic_manager 4.6.0.21universal_gateway 4.6.0.21Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59718Critical· 9.1A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy…
CVE-2026-48558Critical· 10.0SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow
CVE-2013-3900Medium· 5.5Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supp…
CVE-2025-8154Medium· 5.3In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
CVE-2025-8325Medium· 6.3The software fails to enforce role-based access controls for certain Gateway API invocations
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser