Vibe Coding
Kong API Gateway Enterprise accepts forged JWTs on its MCP OAuth2 path via algorithm confusion
CVE-2026-14916 (7.7 HIGH, published 2026-09-16) affects Kong components performing JWT validation for MCP OAuth2 or DataKit integrations in Kong API Gateway Enterprise. The code does not validate that the JWT signing algorithm is compatible with the key type used for verification, so an unauthenticated remote attacker can craft a forged JWT that validates, giving authentication bypass. This is the classic alg-confusion class, now sitting directly in front of MCP traffic for anyone who put Kong there as the auth boundary.
Source
↳ Follow the thread