Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

Summary: A critical flaw in WSO2 API Manager, CVE-2026-5430 with a CVSS score of 9.8, allows JWT authentication to be bypassed when a token is signed with an unsupported algorithm and approved anyway, and watchTowr reports active in-the-wild exploitation attempts. Its honeypot network captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, affecting API Manager 4.1.0 through 4.6.0, API Control Plane, Traffic Manager and Universal Gateway.
Why it matters: A forged admin token on an API gateway sits directly in the path of every request to internal systems, exposing backend credentials, consumer keys and secrets for every registered application, and giving attackers what watchTowr calls lateral movement-as-a-service.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-5430
Related: CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 24, 2026
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026