CVE-2026-5430
CVSS 10 CRITICAL: the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. EPSS 0.2% (13th percentile).
Vulnerabilities & Exploits · Web App Attack
WSO2’s API Manager and related gateway products are under active exploitation attempts for CVE-2026-5430, a JWT verification flaw that lets forged tokens be accepted as if they were valid administrator credentials. watchTowr says its honeypots saw attacker JWTs with built-in admin privileges on September 13.
The bug is simple but dangerous: the service is supposed to reject tokens signed with unsupported algorithms, but it approves them anyway. That lets an attacker present a fake admin badge, reach the control plane, and potentially change gateway behavior or pull credentials tied to backend APIs and connected services.
For teams that use WSO2 as the trust layer in front of internal services, the exposure is not confined to the product UI. A compromised gateway can become a pivot point into the systems behind it, and a patch that only addresses the CVE does not erase any downstream access already granted through that trusted path.
1 source · 2h ago
CVSS 10 CRITICAL: the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. EPSS 0.2% (13th percentile).
The Hacker News
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
WSO2 API Manager JWT bypass faces active exploitation attempts using forged tokens with administrator privileges.
originalPart of the PlainSec briefing for 2026-09-16
Every edition of this story: WSO2 JWT Flaw Hands Out Admin Tokens