Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.
- CVE-2026-5430 (CVSS 10.0 per watchTowr): JWT auth bypass via unsupported signing algorithms
- Forged admin-privilege JWT tokens observed in honeypots on September 13, 2026
- Exploitation could expose backend endpoint credentials, consumer keys, and secrets
- Affects API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway
- CVEs
- CVE-2026-5430
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-5430 | Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways | 10.0 | 22% | KEVPoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9. 8/10.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.