Security researchers at watchTowr have confirmed active exploitation attempts targeting CVE-2026-5430 (CVSS 9.8), a critical authentication bypass in WSO2 API Manager. The vulnerability stems from improper verification of JWT cryptographic signatures: by signing a token with an unsupported algorithm, an attacker can forge a token that WSO2 accepts as valid — including tokens that claim administrator privileges. A successful attack leads to full account takeover of the API management platform and, by extension, access to every internal API it exposes. WSO2 disclosed the flaw and issued patches in May 2026, but months later, exploitation attempts are actively ongoing, suggesting a significant number of deployments have not applied the fix.
WSO2 API Manager is widely used in enterprise environments to publish, manage, and secure APIs across organizations. Compromise of the platform can hand attackers direct access to internal microservices, customer data APIs, and backend systems — all without needing credentials for those individual services. The same JWT bypass also affects WSO2 API Control Plane, Traffic Manager, and Universal Gateway in their recent versions.
How to check if you’re affected
Affected versions include WSO2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, and 4.6.0, as well as WSO2 API Control Plane, Traffic Manager, and Universal Gateway 4.5.0 and 4.6.0. Subscription holders should apply the corresponding update level (for example, API Manager 4.6.0 requires update level 21 or later; 4.5.0 requires update level 57 or later). Non-subscription users should upgrade to the latest available release from the WSO2 website. As a detective measure, review your WSO2 access logs for requests containing malformed or algorithmically unusual JWT tokens, and audit administrator-level API activity for access patterns that predate your patching date.
Sources
- The Hacker News: Active Exploitation Attempts Target WSO2 API Manager JWT Bypass
- WSO2 Security Advisory WSO2-2026-5328 (May 2026)
- CVE-2026-5430 at CVE.org