As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Kong | Kong Enteprise Gateway | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://developer.konghq.com/gateway/changelog/ |
|
Wed, 16 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 16 Sep 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for verification. As a result, an unauthenticated remote attacker may be able to craft a forged JWT that is incorrectly accepted as valid, leading to authentication bypass and potential compromise of confidentiality, integrity, and availability. | |
| Title | Kong API Gateway Enterprise: JWT Algorithm-Confusion | |
| Weaknesses | CWE-241 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Kong
Published:
Updated: 2026-09-16T13:26:46.569Z
Reserved: 2026-07-07T07:14:53.612Z
Link: CVE-2026-14916
Vulnrichment
Updated: 2026-09-16T13:26:43.516Z
NVD
Status : Received
Published: 2026-09-16T11:16:40.503
Modified: 2026-09-16T14:17:03.563
Link: CVE-2026-14916
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-241
Improper Handling of Unexpected Data Type