actively-exploited-vulnerabilityidentity-authentication-vulnerabilityrapid-weaponizationwidely-deployed-product-advisory

Active Exploitation of Critical WSO2 JWT Authentication Bypass

Active Exploitation · 6 sources · Updated 2mo ago · First seen Sep 16, 2026

Attackers are actively exploiting CVE-2026-5430, a CVSS 10 authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw results from improper JWT signature verification: vulnerable services accept tokens signed with unsupported algorithms, allowing attackers to forge JWTs with administrator privileges and bypass authentication. WatchTowr recorded exploitation attempts against its honeypots using forged administrative tokens.

Successful compromise can enable full administrative account takeover and expose API backend endpoints, registered application credentials, consumer keys, and other secrets. Attackers may also be able to intercept data in transit and access internal services reachable through affected API deployments. WSO2 released fixes in April 2026 through community pull requests and subscription update levels; organizations should apply the relevant updates immediately and investigate WSO2 environments for unauthorized administrator tokens or account activity.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Apr 2026 – Sep 13, 2026

Sep 13, 20262mo ago
watchTowr detects attempted exploitation in honeypot
watchTowr's honeypot network recorded its first attempt to exploit CVE-2026-5430, involving forged JWTs containing administrator privileges. watchTowr reproduced the exploit by replaying the observed payload against the applicable WSO2 product.
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
Aug 2026
CVE-2026-5430 record is published
The CVE record for the WSO2 authentication-bypass vulnerability was published in early August 2026.
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - SecurityWeek
May 2026
WSO2 publishes advisory for CVE-2026-5430
WSO2 published a security advisory for critical JWT authentication-bypass vulnerability CVE-2026-5430 and made fixes available through community pull requests and support-subscription update levels.
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
Apr 2026
WSO2 patches JWT authentication-bypass flaw
WSO2 patched CVE-2026-5430, an authentication-bypass flaw affecting API Manager and related middleware products. The flaw allows forged JWTs signed with unsupported algorithms to be accepted.
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - SecurityWeek

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

JWT Algorithm Validation Authentication Bypass in WSO2 API Management Products (CVE-2026-5430)

Affected products

4 linked

Wso2 Api Control PlaneWso2 Universal GatewayWso2 Api ManagerWso2 Traffic Manager

Organizations

1 linked

Wso2

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Sep 16, 2026

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin AccessOpen source ↗

Cryptika BlogNews · Sep 16, 2026

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access | Cryptika CybersecurityOpen source ↗

Security WeekNews · Sep 16, 2026

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - SecurityWeekOpen source ↗

The Hacker NewsNews · Sep 16, 2026

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin TokensOpen source ↗

UnclassifiedNews · May 13, 2026

watchTowr | Preemptive Exposure Management for AI-Driven Attack TimelinesOpen source ↗

Wso2 SecurityNews · May 3, 2026

Security Advisory WSO2-2026-5328/CVE-2026-5430 - WSO2 Security and Compliance DocumentationOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News