{"vulnerability": "CVE-2026-5430", "sightings": [{"uuid": "80690c57-5a9f-4882-ae35-fbc9be6e0a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb", "content": "CVE-2026-5430 - Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover\nCVE ID : CVE-2026-5430\n \n Published : Aug. 6, 2026, 7:33 a.m. | 47\u00a0minutes ago\n \n Description : The JWT authentication mechanism accepts tokens signed with algori...", "creation_timestamp": "2026-08-06T08:34:33.578188Z"}, {"uuid": "87a0b1bf-6f7f-4c44-8c3e-af7732f2bba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117047743616861031", "content": "WSO2 Universal Gateway v4.5.0 & 4.6.0 affected by CRITICAL CVE-2026-5430 (CVSS 10.0). Improper JWT validation enables account takeover. No patch yet \u2014 apply compensating controls. https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-f913080655427dd8 #OffSeq #WSO2 #JWT #Vulnerability", "creation_timestamp": "2026-08-06T09:00:30.800898Z"}, {"uuid": "31dad500-a395-49aa-85f6-56a77d9fe2b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfojgm2gi26", "content": "CRITICAL vuln: CVE-2026-5430 in WSO2 Universal Gateway (4.5.0/4.6.0) allows JWT auth bypass and full account takeover. No patch \u2014 restrict access & monitor logins. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-...", "creation_timestamp": "2026-08-06T09:00:33.688442Z"}, {"uuid": "da1382f4-c7e7-447d-a48b-123dd2dfc59b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msfopshjtl2s", "content": "CVE-2026-5430\nThe JWT authentication in [Software Name] can accept tokens signed with unknown algorithms, allowing attackers to gain unauthorized access to the system. This could lead to the compromise of administrative\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-06T09:04:06.494696Z"}, {"uuid": "357b3317-50c0-4279-82f2-485d3006f597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27", "content": "WSO2 patched seven flaws across API Manager and gateways, led by a CVSS 10 JWT auth bypass (CVE-2026-5430). Update WSO2 API Manager now.\n\n#WSO2 #APISecurity #CVE #AuthBypass #Cybersecurity #Infosec", "creation_timestamp": "2026-06-30T02:45:20.842503Z"}, {"uuid": "6929badb-9a39-436b-8c6f-1f5ccb222585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5430", "content": "", "creation_timestamp": "2026-08-06T12:15:04.860463Z"}, {"uuid": "84a48454-f233-44c8-8e37-4d1072187fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpivzdggor26", "content": "\ud83d\udccc CVE-2026-54305 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature ... https://www.cyberhub.blog/cves/CVE-2026-54305", "creation_timestamp": "2026-06-30T11:37:07.542103Z"}, {"uuid": "00d10c1f-936a-4cb0-bbf5-7895c159f991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54309", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mplesml2b72x", "content": "\ud83d\udccc CVE-2026-54309 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint ... https://www.cyberhub.blog/cves/CVE-2026-54309", "creation_timestamp": "2026-07-01T11:07:08.098988Z"}, {"uuid": "ba740818-4513-4212-a89e-d43e14d230dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54307", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqm67u2njg2l", "content": "\ud83d\udccc CVE-2026-54307 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow... https://www.cyberhub.blog/cves/CVE-2026-54307", "creation_timestamp": "2026-07-14T12:07:06.248680Z"}, {"uuid": "441ad4ab-37f7-4ed1-8ae8-54284faad726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4aq3wk2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:30.162014Z"}, {"uuid": "787fc6c8-848f-4078-ac53-785020325423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl4m22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.048475Z"}, {"uuid": "0dda6218-6691-4f3a-bbc8-87c274a04850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl5lc2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.916425Z"}, {"uuid": "fba1d04a-6503-417b-8610-74d496b69f00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl7js2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:32.797233Z"}, {"uuid": "b40bc908-df8a-4a2a-a1af-44f8cac89b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:33.694832Z"}, {"uuid": "f06ffa6b-e9da-4cab-a4e2-9b509e56c958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj32m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:34.529646Z"}, {"uuid": "62ae6ae8-8fe4-4666-94de-f7f805aafeef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj42m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:35.373392Z"}, {"uuid": "887a547d-c0d6-4eed-b3aa-39943ff8089e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4clbie2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:36.277483Z"}, {"uuid": "feaaf757-a4e7-4184-8ee5-b9fa89c4a87c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54300", "type": "seen", "source": "https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78", "content": "# GHSA-HP3V-MFQW-H74C: GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C\n\n## Summary\nA security vulnerability in @astrojs/netlify allows attackers to bypass remote image path restrictions by leveraging unescaped regular expression metacharacters. The integration adapter fails to sanitize developer-defined pathnames before interpolating them into a configuration JSON file consumed by Netlify's Edge Image CDN. This results in overly permissive matching behavior at the edge routing layer, enabling path-traversal and filter bypasses.\n\n## TL;DR\nThe @astrojs/netlify adapter fails to escape dots and other regular expression metacharacters in developer-defined image pathnames, generating insecure edge configurations that permit attackers to bypass path-level restrictions on Netlify's Image CDN.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-185: Incorrect Regular Expression / CWE-116: Improper Output Escaping\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Filter Bypass / Resource Hijacking\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Astro applications deployed on Netlify using @astrojs/netlify < 8.1.2\n- **@astrojs/netlify**: < 8.1.2 (Fixed in: `8.1.2`)\n\n## Mitigation\n\n- Upgrade @astrojs/netlify integration to version 8.1.2 or higher\n- Avoid utilizing dot characters or special regular expression symbols inside pathnames in astro.config.mjs remotePatterns\n- Restrict the configured remotePatterns hostname to highly specific subdomains or folders to limit bypass surface\n\n**Remediation Steps:**\n1. Run 'npm install @astrojs/netlify@latest' (or equivalent package manager command) to update the package to version 8.1.2 or later\n2. Verify the output by building the project locally using 'npm run build'\n3. Examine the generated '.netlify/v1/config.json' and verify that dots in pathnames are preceded by double backslashes (e.g., '\\\\.')\n\n## References\n\n- [GitHub Security Advisory GHSA-hp3v-mfqw-h74c](https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c)\n- [Related Vulnerability GHSA-529g-xq4f-cw38 (CVE-2026-54300)](https://github.com/advisories/GHSA-529g-xq4f-cw38)\n- [Astro Pull Request #17018](https://github.com/withastro/astro/pull/17018)\n- [Main Astro Repository](https://github.com/withastro/astro)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T04:31:23.737630Z"}]}