Loading story…
Attackers are actively exploiting CVE-2026-5430, a CVSS 10 authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw results from improper JWT signature verification: vulnerable services accept tokens signed with unsupported algorithms, allowing attackers to forge JWTs with administrator privileges and bypass authentication. WatchTowr recorded exploitation attempts against its honeypots using forged administrative tokens.
Successful compromise can enable full administrative account takeover and expose API backend endpoints, registered application credentials, consumer keys, and other secrets. Attackers may also be able to intercept data in transit and access internal services reachable through affected API deployments. WSO2 released fixes in April 2026 through community pull requests and subscription update levels; organizations should apply the relevant updates immediately and investigate WSO2 environments for unauthorized administrator tokens or account activity.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
watchTowr's honeypot network recorded its first attempt to exploit CVE-2026-5430, involving forged JWTs containing administrator privileges. watchTowr reproduced the exploit by replaying the observed payload against the applicable WSO2 product.
The CVE record for the WSO2 authentication-bypass vulnerability was published in early August 2026.
WSO2 published a security advisory for critical JWT authentication-bypass vulnerability CVE-2026-5430 and made fixes available through community pull requests and support-subscription update levels.
WSO2 patched CVE-2026-5430, an authentication-bypass flaw affecting API Manager and related middleware products. The flaw allows forged JWTs signed with unsupported algorithms to be accepted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcethehackernews.com
Open sourcewatchtowr.com
Open sourcesecurity.docs.wso2.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
A public proof-of-concept exploit is available for **CVE-2026-84115**, a high-severity authentication-bypass and privilege-escalation flaw in Cleo Harmony's JWT refresh-token handling. Remote attackers can manipulate Bearer-token arguments sent to the `/api/connections` endpoint to bypass access controls and obtain elevated, potentially administrative, permissions; some attack paths may not require valid credentials. The vulnerability affects Cleo Harmony versions through `5.8.1.10` and could expose managed file-transfer data or enable manipulation of connected integration workflows, particularly on internet-exposed deployments. Cleo fixed the issue in version `5.8.1.11`; organizations should upgrade immediately and review API and token activity for suspicious requests while remediation is underway. No confirmed in-the-wild exploitation of this specific flaw was reported.
Sep 3, 2026
A critical vulnerability in Oracle Identity Manager, identified as CVE-2025-61757 and rated 9.8 on the CVSS scale, is being actively exploited by threat actors. The flaw affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, allowing unauthenticated attackers to remotely execute code via the Oracle REST Web Services component. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about ongoing exploitation, and researchers from Searchlight Cyber have detailed how attackers can bypass authentication by appending specific strings such as `?WSDL` or `;.wadl` to REST endpoints. Organizations using affected Oracle Identity Manager versions are urged to apply the vendor's recent patches immediately to mitigate the risk of compromise. The vulnerability's active exploitation highlights the importance of timely patch management and monitoring for unusual activity on exposed Oracle REST Web Services endpoints. Security teams should review their systems for signs of unauthorized access and ensure that all mitigations recommended by Oracle and CISA are implemented without delay.
Jun 29, 2026