WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass

What to do

1. List every WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway node and run ./wso2update_linux current-state from <product-home>/bin.
2. Update each node to the level in WSO2-2026-5328 or higher, or build with the public fix PRs if you run community builds; restart every node.
3. Restrict the publisher, admin and devportal consoles and management APIs to trusted networks.
4. Rotate consumer keys and secrets for registered applications, and admin credentials, on any node that was unpatched after Sep 13, 2026.
5. Rebuild container images from the patched product pack instead of restarting old ones.

How to check if you are affected or compromised

• Decode the JWT headers in gateway and access logs and flag any alg value your deployment does not issue or configure.
• Review admin, publisher and devportal audit logs for logins, new applications, new subscriptions or key generations you cannot explain, especially from Sep 13, 2026 onward.
• Look for API calls to backends from unexpected sources or with admin scopes that no real client holds.
• Treat any unpatched, internet-exposed node as possibly compromised and check what credentials and backend traffic it could see.

What happened#

On May 3, 2026, WSO2 published advisory WSO2-2026-5328 for CVE-2026-5430, an authentication bypass in WSO2's API management products. In WSO2's words, "JWT authentication can be bypassed when a token is signed using an unsupported algorithm." The validator accepts a token signed with an algorithm it was never configured to trust, so an attacker can mint their own token. WSO2 says the result can be "compromise of administrative accounts and full account takeover." WSO2 rates it CVSS 3.1 10.0, or 9.8 in single-tenant deployments. The Hacktron team reported it. WSO2 told The Hacker News that it alerted customers and shipped updates on April 6. The CVE record was published on August 6.

watchTowr told The Hacker News that its honeypots captured forged JWTs carrying administrator privileges on September 13. CISA added the CVE to the KEV catalog on September 24, with a federal deadline of September 27.

One discrepancy is worth knowing. CISA's KEV entry calls this a "path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution." Neither WSO2's advisory nor the CVE record says that. Both describe a JWT signature-validation bypass, and CISA's own CWE tag, CWE-347 (improper verification of a cryptographic signature), matches the JWT description. Whether attackers chain the bypass into file upload and code execution has not been disclosed as of Oct 21, 2026. The fix is the same either way.

Who is affected#

Per WSO2 and the CVE record:

• API Manager 4.1.0 through 4.6.0. Fixed at update levels 257 (4.1.0), 197 (4.2.0), 108 (4.3.0), 72 (4.4.0), 57 (4.5.0) and 21 (4.6.0).
• API Control Plane 4.5.0 (fixed at update 58) and 4.6.0 (update 22).
• Traffic Manager 4.5.0 (update 56) and 4.6.0 (update 21).
• Universal Gateway 4.5.0 (update 57) and 4.6.0 (update 21).

The CVE record marks API Manager versions before 4.1.0 as "unknown," not unaffected. Community users without a subscription get the fix through two public pull requests, carbon-apimgt #13752 and product-apim #14167, or by moving to a release that includes them. WSO2 lists no workaround.

Do you really need to act?#

Yes, if you run one of these products yourself and are below the fixed update level. The attack needs no credentials, and a forged admin token on an API gateway is worth a lot. watchTowr's Yordan Ganchev said the tokens could reach every API backend and expose credentials, consumer keys and secrets for every registered application. Because the gateway sits in front of internal services, it can also expose data in transit and give attackers a path inward. The fix has been available since April. Anyone still exposed has had more than five months of runway and now faces active scanning.

If you applied WSO2's April updates, you are covered. WSO2 told The Hacker News it had "not identified any impact on customers who applied the recommended updates." Patched teams should still check logs from before they updated.

What to do now#

1. On each node, from <product-home>/bin, run ./wso2update_linux current-state to see the update level, then ./wso2update_linux check for newer ones. Both are documented in WSO2's update tool reference.
2. Update every API Manager, Control Plane, Traffic Manager and Gateway node to the advisory's level or higher, then restart. For community builds, apply the two fix PRs and rebuild.
3. Rebuild and redeploy container images from the patched pack. Restarting an old image does not patch it.
4. Restrict the admin, publisher and devportal consoles and management REST APIs to trusted networks.
5. If a node was unpatched and reachable after September 13, rotate admin passwords and application consumer keys and secrets, and any backend credentials the gateway holds.

How to tell if you were hit#

No indicators of compromise have been published as of Oct 21, 2026. Start with the tokens themselves: decode the JWT headers seen by the gateway and flag any alg value your deployment does not issue. Then review admin and publisher audit logs for logins, new applications, subscriptions and key generations nobody on your team made, especially from September 13 onward. Check backend logs for requests that came through the gateway with admin-level scopes no real client holds. If an internet-facing node ran unpatched during that window, treat the keys, secrets and backend traffic it handled as exposed.

Timeline#

• Apr 6, 2026 — WSO2 says it alerted customers and released updates.
• May 3, 2026 — WSO2 publishes advisory WSO2-2026-5328.
• Aug 6, 2026 — The CVE record is published, as reflected on NVD.
• Sep 13, 2026 — watchTowr captures forged admin JWTs on its honeypots.
• Sep 24, 2026 — CISA adds CVE-2026-5430 to KEV.
• Sep 27, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-5430 · KEV 2026-09-24 · The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. WSO2 — Security Advisory WSO2-2026-5328 / CVE-2026-5430 security.docs.wso2.com
2. CVE record — CVE-2026-5430 cve.org
3. NVD — CVE-2026-5430 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-5430 cisa.gov
5. WSO2 / GitHub — carbon-apimgt fix (PR 13752) github.com
6. WSO2 / GitHub — product-apim fix (PR 14167) github.com
7. WSO2 — Useful Update Commands updates.docs.wso2.com

Coverage and analysis

1. The Hacker News — Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens thehackernews.com
2. The Hacker News — WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV thehackernews.com