---
title: "WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass"
url: https://erroneo.us/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/
description: "Forged JWTs with unsupported algorithms give admin access to WSO2 API Manager 4.1-4.6 and gateways. Exploited since Sep 13; fixes date to April. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-05-03
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-5430"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# WSO2 API Manager CVE-2026-5430: Exploited JWT Auth Bypass

**Verdict: Act now.** Any self-managed WSO2 API Manager 4.1-4.6, API Control Plane, Traffic Manager or Universal Gateway below the fixed update level should be patched now and checked for forged-token use; attackers have been sending forged admin JWTs since mid-September.

- **Who must act:** Teams running WSO2 API Manager 4.1.0-4.6.0, or API Control Plane, Traffic Manager or Universal Gateway 4.5.0/4.6.0, without the April 2026 update levels or the public fix PRs.
- **Who can relax:** Deployments already at or above the update levels in WSO2-2026-5328, and WSO2 products not listed in the advisory, such as Identity Server.
- **Affected:** WSO2 API Manager 4.1.0 before update 257; WSO2 API Manager 4.2.0 before update 197; WSO2 API Manager 4.3.0 before update 108; WSO2 API Manager 4.4.0 before update 72; WSO2 API Manager 4.5.0 before update 57; WSO2 API Manager 4.6.0 before update 21; WSO2 API Control Plane 4.5.0 before update 58 and 4.6.0 before update 22; WSO2 Traffic Manager 4.5.0 before update 56 and 4.6.0 before update 21; WSO2 Universal Gateway 4.5.0 before update 57 and 4.6.0 before update 21
- **Fixed:** API Manager 4.1.0 U257, 4.2.0 U197, 4.3.0 U108, 4.4.0 U72, 4.5.0 U57, 4.6.0 U21; API Control Plane 4.5.0 U58, 4.6.0 U22; Traffic Manager 4.5.0 U56, 4.6.0 U21; Universal Gateway 4.5.0 U57, 4.6.0 U21; Community builds: wso2/carbon-apimgt PR 13752 and wso2/product-apim PR 14167
- **CVEs:** CVE-2026-5430
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway node and run ./wso2update_linux current-state from <product-home>/bin.
2. Update each node to the level in WSO2-2026-5328 or higher, or build with the public fix PRs if you run community builds; restart every node.
3. Restrict the publisher, admin and devportal consoles and management APIs to trusted networks.
4. Rotate consumer keys and secrets for registered applications, and admin credentials, on any node that was unpatched after Sep 13, 2026.
5. Rebuild container images from the patched product pack instead of restarting old ones.

### How to check if you are affected

- Decode the JWT headers in gateway and access logs and flag any alg value your deployment does not issue or configure.
- Review admin, publisher and devportal audit logs for logins, new applications, new subscriptions or key generations you cannot explain, especially from Sep 13, 2026 onward.
- Look for API calls to backends from unexpected sources or with admin scopes that no real client holds.
- Treat any unpatched, internet-exposed node as possibly compromised and check what credentials and backend traffic it could see.

## What happened

On May 3, 2026, WSO2 published advisory [WSO2-2026-5328](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/) for CVE-2026-5430, an authentication bypass in WSO2's API management products. In WSO2's words, "JWT authentication can be bypassed when a token is signed using an unsupported algorithm." The validator accepts a token signed with an algorithm it was never configured to trust, so an attacker can mint their own token. WSO2 says the result can be "compromise of administrative accounts and full account takeover." WSO2 rates it CVSS 3.1 10.0, or 9.8 in single-tenant deployments. The Hacktron team reported it. WSO2 told [The Hacker News](https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html) that it alerted customers and shipped updates on April 6. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-5430) was published on August 6.

watchTowr told [The Hacker News](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html) that its honeypots captured forged JWTs carrying administrator privileges on September 13. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430) on September 24, with a federal deadline of September 27.

One discrepancy is worth knowing. CISA's KEV entry calls this a "path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution." Neither WSO2's advisory nor the CVE record says that. Both describe a JWT signature-validation bypass, and CISA's own CWE tag, CWE-347 (improper verification of a cryptographic signature), matches the JWT description. Whether attackers chain the bypass into file upload and code execution has not been disclosed as of Oct 21, 2026. The fix is the same either way.

## Who is affected

Per WSO2 and the CVE record:

- **API Manager** 4.1.0 through 4.6.0. Fixed at update levels 257 (4.1.0), 197 (4.2.0), 108 (4.3.0), 72 (4.4.0), 57 (4.5.0) and 21 (4.6.0).
- **API Control Plane** 4.5.0 (fixed at update 58) and 4.6.0 (update 22).
- **Traffic Manager** 4.5.0 (update 56) and 4.6.0 (update 21).
- **Universal Gateway** 4.5.0 (update 57) and 4.6.0 (update 21).

The CVE record marks API Manager versions before 4.1.0 as "unknown," not unaffected. Community users without a subscription get the fix through two public pull requests, [carbon-apimgt #13752](https://github.com/wso2/carbon-apimgt/pull/13752) and [product-apim #14167](https://github.com/wso2/product-apim/pull/14167), or by moving to a release that includes them. WSO2 lists no workaround.

## Do you really need to act?

Yes, if you run one of these products yourself and are below the fixed update level. The attack needs no credentials, and a forged admin token on an API gateway is worth a lot. watchTowr's Yordan Ganchev said the tokens could reach every API backend and expose credentials, consumer keys and secrets for every registered application. Because the gateway sits in front of internal services, it can also expose data in transit and give attackers a path inward. The fix has been available since April. Anyone still exposed has had more than five months of runway and now faces active scanning.

If you applied WSO2's April updates, you are covered. WSO2 told The Hacker News it had "not identified any impact on customers who applied the recommended updates." Patched teams should still check logs from before they updated.

## What to do now

1. On each node, from `<product-home>/bin`, run `./wso2update_linux current-state` to see the update level, then `./wso2update_linux check` for newer ones. Both are documented in WSO2's [update tool reference](https://updates.docs.wso2.com/en/latest/updates/update-commands/).
2. Update every API Manager, Control Plane, Traffic Manager and Gateway node to the advisory's level or higher, then restart. For community builds, apply the two fix PRs and rebuild.
3. Rebuild and redeploy container images from the patched pack. Restarting an old image does not patch it.
4. Restrict the admin, publisher and devportal consoles and management REST APIs to trusted networks.
5. If a node was unpatched and reachable after September 13, rotate admin passwords and application consumer keys and secrets, and any backend credentials the gateway holds.

## How to tell if you were hit

No indicators of compromise have been published as of Oct 21, 2026. Start with the tokens themselves: decode the JWT headers seen by the gateway and flag any `alg` value your deployment does not issue. Then review admin and publisher audit logs for logins, new applications, subscriptions and key generations nobody on your team made, especially from September 13 onward. Check backend logs for requests that came through the gateway with admin-level scopes no real client holds. If an internet-facing node ran unpatched during that window, treat the keys, secrets and backend traffic it handled as exposed.

## Timeline

- Apr 6, 2026 — WSO2 says it alerted customers and released updates.
- May 3, 2026 — WSO2 publishes advisory WSO2-2026-5328.
- Aug 6, 2026 — The CVE record is published, as reflected on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-5430).
- Sep 13, 2026 — watchTowr captures forged admin JWTs on its honeypots.
- Sep 24, 2026 — CISA adds CVE-2026-5430 to KEV.
- Sep 27, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [WSO2 — Security Advisory WSO2-2026-5328 / CVE-2026-5430](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)
2. [CVE record — CVE-2026-5430](https://www.cve.org/CVERecord?id=CVE-2026-5430)
3. [NVD — CVE-2026-5430](https://nvd.nist.gov/vuln/detail/CVE-2026-5430)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-5430](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430)
5. [WSO2 / GitHub — carbon-apimgt fix (PR 13752)](https://github.com/wso2/carbon-apimgt/pull/13752)
6. [WSO2 / GitHub — product-apim fix (PR 14167)](https://github.com/wso2/product-apim/pull/14167)
7. [WSO2 — Useful Update Commands](https://updates.docs.wso2.com/en/latest/updates/update-commands/)
8. [The Hacker News — Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html)
9. [The Hacker News — WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV](https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html)

---
Source page: https://erroneo.us/security/briefs/wso2-api-manager-cve-2026-5430-jwt-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt