Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.
WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.
- CVE-2026-5430 (CVSS 10.0) allows JWT authentication bypass leading to potential admin account takeover
- WatchTowr honeypots observed the first exploitation attempt on September 13
- Forged tokens expose API backend endpoints, credentials, and consumer keys and secrets
- Affected products include API Manager, API Control Plane, Traffic Manager, and Universal Gateway
- Flaw was patched in April, but the CVE record was only published in early August
- CVEs
- CVE-2026-5430
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1550.001 Application Access TokenT1078 Valid AccountsT1557 Adversary-in-the-Middle
- Countries
- United Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityweek.com
The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data. The post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.