Summary
- CVE-2026-5430 allows JWT authentication to be bypassed across several WSO2 API products.
- WSO2 says successful exploitation can lead to unauthorised access and administrative account takeover.
- watchTowr observed forged tokens with administrator privileges hitting its honeypots on 13 September.
A critical authentication-bypass vulnerability in WSO2 API products is being targeted in active attacks, months after fixes were released for a flaw capable of enabling unauthorised access and administrative account takeover.
CVE-2026-5430 affects WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway across several supported versions.
WSO2 rates the issue critical, with a CVSS score of 10 in some deployment models and 9.8 where the impact is contained within a single security authority.
The flaw concerns JSON Web Token authentication. WSO2 says authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorised access. Successful exploitation may include compromise of administrative accounts and complete account takeover.
WSO2 published its advisory on 3 May and made fixes available for both support customers and community users. Exposure-management company watchTowr has now observed forged JWT tokens targeting the vulnerability in its honeypot network.
The company’s researchers said tokens containing administrator privileges were observed on 13 September. That provides evidence of active exploitation attempts, although it does not establish how many production systems have been successfully compromised.
API-management systems are strategically placed in enterprise architecture because they can authenticate, inspect, and route requests between external users, applications, partners, and internal services.
A compromise at that layer may therefore expose credentials, application secrets, backend services, or data flows that are not otherwise directly reachable from the internet.
The authentication failure is particularly serious because the API gateway itself is intended to enforce trust decisions. If an attacker can forge a token accepted by the platform, downstream services may receive traffic that appears to have passed an authorised control point.
WSO2 says the products are used by enterprise customers across sectors including banking, government, telecoms, and logistics, with further deployments through open-source use and partners.
There is not yet a public basis for attributing the current exploitation attempts to a named group or for estimating the number of affected organisations. Attempted exploitation observed in a honeypot should also be distinguished from confirmed compromise of production environments.
The delay between disclosure and observed attacks is nevertheless familiar. Attackers can begin targeting a vulnerability after reproducing a patch, developing reliable exploitation, or identifying a sufficiently large number of exposed systems.
That can leave older installations in development, regional, acquired, or disaster-recovery environments exposed even when primary systems have already been updated.
API infrastructure also combines several risk domains that are often managed separately: software patching, identity, token validation, privileged administration, and connectivity to internal services. CVE-2026-5430 demonstrates how a failure at that intersection can turn one middleware component into a route towards multiple applications.
WSO2’s fixes have been available since May. With exploitation attempts now observed, the remaining exposure depends heavily on whether organisations have an accurate inventory of every affected deployment and have applied the relevant update level.
