Reported by 15 outlets
WSO2 API Manager CVE-2026-5430 JWT auth bypass under active exploitation
Why this score
- Breadth
- 2.00 / 2.0 · 15 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
CVE-2026-5430 is a critical JWT authentication bypass in WSO2 API management products: the token validation mechanism accepts tokens signed with algorithms other than those explicitly configured or supported, so a crafted JWT validates and grants unauthorized access, up to administrative account takeover. NVD scores it CVSS 3.1 10.0 with scope changed (9.8 adjusted for single-tenant deployments), network vector, no privileges or user interaction. Affected: API Manager 4.1.0 through 4.6.0, plus API Control Plane, Traffic Manager, and Universal Gateway 4.5.0 and 4.6.0. WSO2 reports nearly 1,000 enterprise customers in banking, government, telecom and logistics, with thousands more on open source deployments.
The disclosure timeline is a lesson in quiet fixes. The remediation landed in the open source codebase in April 2026 under innocuous titles: carbon-apimgt PR 13752 merged April 12 and product-apim PR 14167 merged April 22, both "Improve exception handling" style names that gave no hint of severity. Vendor advisory WSO2-2026-5328 followed in May, crediting the Hacktron Team; NVD published the record August 6. WatchTowr's honeypot network recorded the first in-the-wild exploitation attempt on September 16, and SecurityWeek reported active attacks chasing sensitive enterprise data on unpatched servers.
On September 24 CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline, grouping it with CVE-2026-71362, an Adobe Commerce and Magento incorrect-authorization bug. Two details complicate response. CISA's own KEV entry describes a path traversal with unrestricted file upload leading to RCE, which contradicts the vendor advisory and NVD, both of which describe JWT algorithm confusion; patching guidance should follow WSO2's advisory, not the KEV description. And the fix predates the exploitation by months, so any victim this week simply never applied it.
Inventory every WSO2 gateway, control plane, traffic manager and API Manager instance against the advisory's per-branch update levels and patch immediately, since KEV listing puts federal systems on a clock and mass scanners will follow. Log for successful auth with anomalous JWT algorithms on admin endpoints. Watch for WSO2 or CISA correcting the KEV description, for exploitation moving from honeypots to confirmed victim disclosures, and for any second bypass in the same JWT pipeline.
Timeline
-
original reporting
🤖 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager under active exploitation. Attackers forge admin tokens via imprope
thehackernews.com · 27d ago · September 16th, 2026
🤖 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager under active exploitation. Attackers forge admin tokens via imprope
via Mastodon https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
-
update from github.com
carbon-apimgt pull request 13752: Improve exception handling
github.com · 184d ago · April 12th, 2026
The open source fix for CVE-2026-5430 in carbon-apimgt was merged on this date under the inconspicuous title "Improve exception handling", three weeks before the vendor advisory. Advisory WSO2-2026-5328 later linked this pull request as the community remediation, so the critical fix sat in the codebase with no public indication of its severity until May.
-
update from github.com
product-apim pull request 14167: Improve advanced configuration tests
github.com · 175d ago · April 22nd, 2026
The second community fix referenced by advisory WSO2-2026-5328, merged into product-apim under a generic testing title about ten days after the carbon-apimgt change. Together the two April merges show the vulnerability was patched in code well before any public disclosure named it or gave it a CVE record.
-
update from security.docs.wso2.com
Security Advisory WSO2-2026-5328/CVE-2026-5430
security.docs.wso2.com · 164d ago · May 3rd, 2026
WSO2's advisory discloses a JWT authentication bypass when a token is signed with an unsupported algorithm, rated Critical at CVSS 10 with scope changed and adjusted to 9.8 for single-tenant deployments. It lists API Manager 4.1.0 through 4.6.0 plus API Control Plane, Traffic Manager, and Universal Gateway 4.5.0 and 4.6.0 as affected, links two community fixes on GitHub, and gives per-branch update levels for subscription holders. WSO2 credits the Hacktron Team for responsibly reporting the issue.
-
update from nvd.nist.gov
NVD: CVE-2026-5430 (WSO2 JWT authentication algorithm confusion)
nvd.nist.gov · 68d ago · August 6th, 2026
The NVD record for CVE-2026-5430, published August 6, 2026, describes a JWT authentication mechanism that accepts tokens signed with algorithms other than those explicitly configured or supported, allowing crafted tokens to validate and leading to unauthorized access with potential compromise of administrative accounts.
-
update from securityweek.com
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
securityweek.com · 27d ago · September 16th, 2026
A critical WSO2 vulnerability patched earlier this year is now being exploited in the wild by threat actors seeking access to sensitive enterprise data. WSO2 is an open source middleware platform that enables organizations to design, secure, integrate, and manage APIs, services, and identities across hybrid and multi-cloud environments. The platform has nearly 1,000 enterprise customers worldwide in sectors such as banking, government, telecom, and logistics. Thousands more have adopted it through open source deployments, OEMs, and partners. Exposure management firm WatchTowr warned on Tuesday that a vulnerability tracked as CVE-2026-5430, which WSO2 patched in April, is being exploited in malicious attacks. The flaw carries a maximum CVSS score of 10. According to a vendor advisory issued in May, it can let attackers bypass authentication and take over accounts. Yordan Ganchev, principal threat intelligence specialist at WatchTowr, told SecurityWeek that the company’s honeypot network saw the first exploitation attempt on September
-
update from www.securityweek.com
Reward: You've received a Contempt of Court Citation, redeemable for nothing. https://www. securityweek.com/enterprises-w arned-of-attacks-e
www.securityweek.com · 27d ago · September 16th, 2026
Reward: You've received a Contempt of Court Citation, redeemable for nothing. https://www. securityweek.com/enterprises-w arned-of-attacks-e
via Mastodon https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/
-
update from beyondmachines.net
WSO2 Warns of Active Exploitation Targeting Critical Authentication Bypass WSO2 is warning of active exploitation of a critical authenticati
beyondmachines.net · 26d ago · September 17th, 2026
WSO2 Warns of Active Exploitation Targeting Critical Authentication Bypass WSO2 is warning of active exploitation of a critical authenticati
via Mastodon https://beyondmachines.net/event_details/wso2-warns-of-active-exploitation-targeting-critical-authentication-bypass-6-5-6-k-k/gD2P6Ple2L
-
update from securebulletin.com
CVSS 10 WSO2 Authentication Bypass Threatens API Control Planes # CyberSecurity https:// securebulletin.com/cvss-10-wso 2-authentication-byp
securebulletin.com · 26d ago · September 17th, 2026
CVSS 10 WSO2 Authentication Bypass Threatens API Control Planes # CyberSecurity https:// securebulletin.com/cvss-10-wso 2-authentication-byp
via Mastodon https://securebulletin.com/cvss-10-wso2-authentication-bypass-threatens-api-control-planes/
-
update from dev.to
WSO2 CVE-2026-5430: Authentication Bypass in API Management Infrastructure via JWT with Unsupported Algorithm # security # threatintel # sof
dev.to · 26d ago · September 17th, 2026
WSO2 CVE-2026-5430: Authentication Bypass in API Management Infrastructure via JWT with Unsupported Algorithm # security # threatintel # sof
via Mastodon https://dev.to/anoymask/wso2-cve-2026-5430-authentication-bypass-in-api-management-infrastructure-via-jwt-with-unsupported-3mc1
-
update from go.dhs.gov
We added WSO2 path traversal vulnerability CVE-2026-5430 & Adobe Commerce & Magento incorrect authorization vulnerability CVE-2026-71362 to
go.dhs.gov · 19d ago · September 24th, 2026
We added WSO2 path traversal vulnerability CVE-2026-5430 & Adobe Commerce & Magento incorrect authorization vulnerability CVE-2026-71362 to
via X https://go.dhs.gov/Z3Q
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:0924] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 19d ago · September 24th, 2026
🚨 [CISA-2026:0924] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0924
-
mentioned by securityonline.info
CISA added two exploited CISA KEV vulnerabilities to its catalog. Patch WSO2 and Adobe Commerce to secure systems against active attacks. #
securityonline.info · 19d ago · September 25th, 2026
-
mentioned by thehackernews.com
🤖 CISA KEV: two actively exploited flaws added. CVE-2026-5430 (CVSS 9.8) — path traversal in WSO2 API Control Plane. Adobe Commerce/Magento
thehackernews.com · 18d ago · September 25th, 2026
-
update from gbhackers.com
CISA Flags WSO2 Security Flaw Under Active Exploitation
gbhackers.com · 18d ago · September 25th, 2026
CISA made this decision after evidence showed threat actors are actively exploiting the flaw. CISA added the vulnerability on September 24, 2026, and set a remediation deadline for affected federal […] The post CISA Flags WSO2 Security Flaw Under Active Exploitation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
CISA Warns of Actively Exploited Critical WSO2 Authentication Bypass Flaw
cyberpress.org · 18d ago · September 25th, 2026
CVE-2026-5430 is a JWT authentication weakness in which the affected mechanism can accept tokens signed with algorithms administrators did not explicitly configure or support. Critical WSO2 Authentication Bypass Flaw This condition could enable a remote, unauthenticated attacker to create a specially crafted JSON Web Token that the target incorrectly validates, potentially bypassing authentication controls. Successful exploitation can result in unauthorized access, compromise of administrative accounts, and complete account takeover. The issue is associated with CWE-347, which covers improper certificate or cryptographic validation weaknesses, although the practical risk here centers on incorrectly accepting JWT signing algorithms. CISA’s KEV entry identifies the affected software family as WSO2 Multiple Products, including WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. The agency describes the vulnerability as a path traversal issue that could allow unrestricted file uploads and ultimately remote code execution, which differs from the JWT authentication bypass. Orga
-
mentioned by www.bleepingcomputer.com
🤖 CISA added two critical bugs to its KEV catalog: CVE-2026-5430, an auth bypass in multiple WSO2 products, and CVE-2026-71362, a critical A
www.bleepingcomputer.com · 18d ago · September 25th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CISA KEV: CVE-2026-5430 (max severity) — JWT auth bypass in WSO2 API Manager 4.1.0-4.6.0 (plus API Control Plane/Traffic Manager/Universal
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
mentioned by www.bleepingcomputer.com
CISA warns of # Sharepoint , # WSO2 , # AdobeCommerce flaws exploited in attacks https://www. bleepingcomputer.com/news/secu rity/cisa-warns
www.bleepingcomputer.com · 17d ago · September 26th, 2026