CVE-2026-5430

CVE-2026-5430 is a textbook algorithm confusion vulnerability in JWT token validation — the system accepts tokens signed with any algorithm it knows, rather than restricting validation to the algorithm(s) the issuer actually uses. An attacker can take a token signed with the public RS256 key and re-sign it using HS256 with that same public key as the secret, bypassing signature verification entirely. The CVSS 10 rating is mathematically accurate: unauthenticated, network-accessible, total compromise. But the rating tells you nothing you didn't already know from the dozens of prior CVEs in this class since 2015. What actually matters here is architectural. The CVSS adjustment from 10 down to 9.8 in single-tenant environments reveals something the raw score obscures: this vulnerable validation logic sits at a platform boundary, not inside a single application. The distinction only makes sense if the compromised component serves multiple tenants — a shared auth service, middleware, or platform-level token validation layer. In single-tenant deployments, the blast radius is contained by the tenant boundary itself. In multi-tenant deployments, a single algorithm confusion exploit collapses every tenant's security simultaneously, because they all trust the same validation layer. The deeper failure isn't this specific implementation — it's the ecosystem pattern. JWT libraries have shipped with permissive algorithm acceptance as the default for over a decade. The secure configuration — explicitly restricting `alg` to only the expected value — requires more code, more developer knowledge, and more explicit configuration than the vulnerable default. Each CVE in this class gets patched, the library improves, and the vulnerability migrates to downstream implementations that copied the old permissive pattern or bypassed validation for "compatibility." The cycle repeats because the economics of library maintenance don't reward permanent remediation. For defenders: verify that your JWT validation explicitly whitelists allowed algorithms and rejects tokens with any unlisted `alg` value. If you use a shared auth service or middleware, treat its compromise as equivalent to total environment compromise — the blast radius cascades across everything trusting those tokens. The CVSS distinction between tenant models is your best proxy for inferring whether you're dealing with application-level risk or platform-level risk that may already be affecting systems beyond your visibility.

Reviewed through automated stages and approved by a human before publication.