WSO2 API Manager Flaw Sees Active Exploitation Attempts

"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access," according to an advisory released by WSO2 in May 2026.

CVE-2026-5430: the vulnerability and its severity

The flaw is tracked as CVE-2026-5430 and was assigned a CVSS score of 9.8 out of 10.0 in published material. WSO2 described the issue as an improper verification of a cryptographic signature that can result in account takeover. Hacktron Team is credited with discovering and reporting the vulnerability.

WSO2 warned that "successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover." WatchTowr, an intelligence firm that has monitored attacks against the bug, described the vulnerability as allowing tokens signed with unsupported algorithms to be accepted and approved anyway; its principal threat intelligence specialist, Yordan Ganchev, said, "So, it's easy to see why this is a critical bug (CVSS 10.0)."

Products and versions explicitly affected

• WSO2 API Control Plane: 4.6.0, 4.5.0
• WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0
• WSO2 Traffic Manager: 4.6.0, 4.5.0
• WSO2 Universal Gateway: 4.6.0, 4.5.0

WSO2 published fixes for users with support subscriptions and provided update-level identifiers for each affected release. The update levels listed in the advisory are specific and should be matched by administrators when applying vendor-supplied patches:

• WSO2 API Control Plane 4.6.0 - Update level 22
• WSO2 API Control Plane 4.5.0 - Update level 58
• WSO2 API Manager 4.6.0 - Update level 21
• WSO2 API Manager 4.5.0 - Update level 57
• WSO2 API Manager 4.4.0 - Update level 72
• WSO2 API Manager 4.3.0 - Update level 108
• WSO2 API Manager 4.2.0 - Update level 197
• WSO2 API Manager 4.1.0 - Update level 257
• WSO2 Traffic Manager 4.6.0 - Update level 21
• WSO2 Traffic Manager 4.5.0 - Update level 56
• WSO2 Universal Gateway 4.6.0 - Update level 21
• WSO2 Universal Gateway 4.5.0 - Update level 57

Active exploitation observed on September 13, 2026

WatchTowr reported that exploitation attempts are occurring in the wild and that its honeypot network captured JWT tokens on September 13, 2026 that contained baked-in administrator privileges. According to watchTowr, the tokens observed in those attempts were forged in a way that leverages acceptance of unsupported signing algorithms.

Ganchev summarized the operational impact: "The flaw exists in the service due to how JWT authentication accepts tokens signed with algorithms it does not support, then approves them anyway." He warned that the forged tokens are suspected to be used to access every API backend endpoint and to harvest credentials, consumer keys, and secrets for every registered application.

WatchTowr further noted the systemic risk posed by the product class: because the affected service sits in the path of API traffic and is designed to intercept requests bound for internal systems, exploitation provides an opportunity "to tap and steal sensitive data in transit and interact with internal services through this 'lateral movement-as-a-service' product."

What this means for technologists, affected enterprises, and adversaries

• Technologists and security teams: Match your deployed product and version against the explicit lists above and apply the vendor updates or pull-request fixes without delay; the advisory and watchTowr observations indicate administrative account compromise is a credible outcome.
• Affected enterprises and procurement leaders: Confirm whether your WSO2 installations include API Manager, API Control Plane, Traffic Manager, or Universal Gateway versions listed and prioritize patch schedules to include the vendor's stated update levels or community pull-request fixes.
• Adversaries and threat actors: The observed patterns show how forged JWTs can be used to access backend endpoints and extract credentials and secrets, enabling further access and data exfiltration from targeted environments.

Immediate mitigation and next steps

Fixes are available in pull requests for community users and have been released for WSO2 Support Subscription Holders at the update levels enumerated above. In light of the active exploitation captured by watchTowr, users are advised to apply the fixes as soon as possible for optimal protection.

The concrete choices facing administrators are straightforward in this instance: identify affected components and versions, install the vendor-specified updates or community fixes, and verify that JWT handling no longer accepts unsupported signing algorithms. The advisory and watchTowr's telemetry provide the technical indicators enterprises need to prioritize remediation.

Original reporting: The Hacker News