Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.
WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.
- CVE-2026-5430 (CVSS 10.0) allows JWT authentication bypass leading to potential admin account takeover
- WatchTowr honeypots observed the first exploitation attempt on September 13
- Forged tokens expose API backend endpoints, credentials, and consumer keys and secrets
- Affected products include API Manager, API Control Plane, Traffic Manager, and Universal Gateway
- Flaw was patched in April, but the CVE record was only published in early August
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-5430 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary. NVD description · AI analysis pending | 10.0 | <1% |
| — |
Full article423 words · extracted from securityweek.com · click to collapse
A critical WSO2 vulnerability patched earlier this year is now being exploited in the wild by threat actors seeking access to sensitive enterprise data.
WSO2 is an open source middleware platform that enables organizations to design, secure, integrate, and manage APIs, services, and identities across hybrid and multi-cloud environments.
The platform has nearly 1,000 enterprise customers worldwide in sectors such as banking, government, telecom, and logistics. Thousands more have adopted it through open source deployments, OEMs, and partners.
Exposure management firm WatchTowr warned on Tuesday that a vulnerability tracked as CVE-2026-5430, which WSO2 patched in April, is being exploited in malicious attacks.
The flaw carries a maximum CVSS score of 10. According to a vendor advisory issued in May, it can let attackers bypass authentication and take over accounts.
“JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,” WSO2 explained, adding, “Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.”
Advertisement. Scroll to continue reading.
The API Manager, API Control Plane, Traffic Manager, and Universal Gateway products are affected.
Yordan Ganchev, principal threat intelligence specialist at WatchTowr, told SecurityWeek that the company’s honeypot network saw the first exploitation attempt on September 13.
Ganchev explained that the attacker used a forged JWT token, which allowed WatchTowr researchers to determine the attacker’s goal.
“The forged token yields access to every API backend endpoint and its credentials, consumer keys and secrets for every registered application,” Ganchev said. “The service is also by definition made to intercept API requests on their way to internal systems, which provides a great opportunity to tap and steal sensitive data in transit and interact with internal services through this ‘Lateral Movement-as-a-Service’ product.”
Ganchev added, “We observed a single attacker targeting the wrong product, but when we replayed their payload on the real one, it worked. Our honeypots were fortunate to be mixed up, but the same may not be guaranteed about real victim systems.”
The expert also noted that the CVE record for CVE-2026-5430 was published only in early August, and technical details still do not appear to be public. However, WatchTowr easily reproduced the vulnerability based on the vendor’s patch.
“The only mystery here is what took everyone else so long,” Ganchev said.
Related: $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
Related: Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/