A severe security flaw in WSO2’s API platform is being actively exploited in the wild. The issue, tracked as CVE-2026-5430, involves improper verification of JSON Web Token (JWT) signatures—allowing attackers to bypass authentication and gain unauthorized access, including full account takeover. Discoveries were made by the Hacktron Team and a watchTowr honeypot detected admin-level forged tokens in use as early as September 13, 2026.
What’s the risk & where it hits
The vulnerability arises when the system accepts JWT tokens signed with unsupported algorithms. Even though the signer algorithm isn’t recognized, the platform still treats the token as valid, allowing attackers to assume administrative roles. The services affected include WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane (4.5.0 & 4.6.0), Traffic Manager (4.5.0 & 4.6.0), and Universal Gateway (4.5.0 & 4.6.0).
The severity is high—CVSS base score is 9.8/10, nearly scoring perfect—because of how broadly this could impact organisations. If exploited, attackers can reach every API backend, harvest credentials (consumer keys and secrets), and access internal services. Since the API infrastructure sits between clients and internal systems, this flaw enables lateral movement, exfiltration, or even internal compromise.
Patches released, public danger ongoing
Fixes are now available. Community users on GitHub can implement patches via specific pull requests. For subscribers with support contracts, updates are released per product and version—e.g. API Manager 4.4.0 up to 4.6.0 have specified update levels. Users are being urged to apply these fixes immediately.
At least one proof of ongoing exploitation has been seen in a honeypot network where forged JWTs with admin privileges were captured on September 13, 2026. Detecting these forged tokens indicates that attackers are targeting many potentially vulnerable deployments—especially those running the listed versions without applied updates.
In light of these findings, organizations using WSO2 API Manager and its related components must immediately assess their versions, ensure patches or updates are applied, and monitor logs for any suspicious token usage. Failure to do so could lead to unauthorized access, data leaks, or more severe compromise.
Analytical angle: This incident underlines a broader trend: JWT misuse remains a bottleneck in API security. Even where JWTs are properly used, weak algorithms or signature verification flaws continue to lead to severe breaches. For enterprises relying on API gateways or microservices architectures, this serves as a wake-up call—security teams must audit not just configuration, but also algorithm support and token verification paths. Going forward, we’ll be watching how WSO2 responds beyond patches—especially in terms of alerting customers, offering mitigation guidance, and ensuring similar bugs don’t resurface with new releases.
