As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://developer.konghq.com/gateway/changelog/ |
|
Wed, 16 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 16 Sep 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability. | |
| Title | Kong API Gateway Enterprise: JWT Algorithm-Confusion | |
| Weaknesses | CWE-241 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Kong
Published:
Updated: 2026-09-16T13:26:46.569Z
Reserved: 2026-07-07T07:14:53.612Z
Link: CVE-2026-14916
Vulnrichment
Updated: 2026-09-16T13:26:43.516Z
NVD
Status : Received
Published: 2026-09-16T11:16:40.503
Modified: 2026-09-16T14:17:03.563
Link: CVE-2026-14916
Redhat
No data.
OpenCVE Enrichment
No data.