CVE-2026-5430
CVSS 10 CRITICAL: the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. EPSS 0.2% (13th percentile).
Vulnerabilities · 2h ago
WSO2’s API Manager and related gateway products are under active exploitation attempts for CVE-2026-5430, a JWT verification flaw that lets forged tokens be accepted as if they were valid administrator credentials. watchTowr says its honeypots saw attacker JWTs with built-in admin privileges on September 13.
The bug is simple but dangerous: the service is supposed to reject tokens signed with unsupported algorithms, but it approves them anyway. That lets an attacker present a fake admin badge, reach the control plane, and potentially change gateway behavior or pull credentials tied to backend APIs and connected services.
For teams that use WSO2 as the trust layer in front of internal services, the exposure is not confined to the product UI. A compromised gateway can become a pivot point into the systems behind it, and a patch that only addresses the CVE does not erase any downstream access already granted through that trusted path.
CVSS 10 CRITICAL: the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. EPSS 0.2% (13th percentile).
1 source covering this story
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
WSO2 API Manager JWT bypass faces active exploitation attempts using forged tokens with administrator privileges.
Part of the PlainSec briefing for 2026-09-16