Full Report
A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw. "JWT authentication
Analysis Summary
# Vulnerability: WSO2 API Manager JWT Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-5430
- **CVSS Score:** 9.8 / 10.0 (Critical)
- **CWE:** Improper Verification of Cryptographic Signature (Related to CWE-347)
## Affected Systems
- **Products:**
- WSO2 API Manager
- WSO2 API Control Plane
- WSO2 Traffic Manager
- WSO2 Universal Gateway
- **Versions:**
- API Manager: 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- API Control Plane, Traffic Manager, and Universal Gateway: 4.5.0, 4.6.0
- **Configurations:** Systems utilizing JWT authentication for API security.
## Vulnerability Description
The vulnerability stems from improper verification of cryptographic signatures within the JWT authentication handler. Specifically, the service accepts JWT tokens signed with algorithms it does not support. Instead of rejecting these tokens as invalid, the system approves them. This logic flaw allows an attacker to forge JWT tokens (e.g., using the "none" algorithm or other unsupported methods) to impersonate any user, including administrative accounts.
## Exploitation
- **Status:** Exploited in the wild. Honeypots have captured active attempts using forged administrator tokens as of September 13, 2026.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to API backend endpoints, credentials, consumer keys, and secrets).
- **Integrity:** High (Ability to interact with internal services and modify data via lateral movement).
- **Availability:** High (Potential for full account takeover and system compromise).
## Remediation
### Patches
**For WSO2 Support Subscription Holders:**
- WSO2 API Manager: 4.6.0 (Level 21), 4.5.0 (Level 57), 4.4.0 (Level 72), 4.3.0 (Level 108), 4.2.0 (Level 197), 4.1.0 (Level 257)
- WSO2 API Control Plane: 4.6.0 (Level 22), 4.5.0 (Level 58)
- WSO2 Traffic Manager: 4.6.0 (Level 21), 4.5.0 (Level 56)
- WSO2 Universal Gateway: 4.6.0 (Level 21), 4.5.0 (Level 57)
**For Community Users:**
- Fixes are available via GitHub pull requests:
- hxxps[://]github[.]com/wso2/carbon-apimgt/pull/13752
- hxxps[://]github[.]com/wso2/product-apim/pull/14167
### Workarounds
No specific configuration workarounds were provided in the context; immediate patching is recommended due to active exploitation.
## Detection
- **Indicators of Compromise:** Look for JWT tokens in logs that utilize unsupported or unusual signature algorithms (e.g., "alg": "none").
- **Detection methods:** Monitor for unauthorized administrative actions or access to sensitive API metadata/credentials originating from unexpected sources. WatchTowr reported honeypot captures of forged tokens with baked-in administrator privileges.
## References
- **Vendor Advisory:** hxxps[://]security[.]docs[.]wso2[.]com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
- **Research/Source:** hxxps[://]x[.]com/inkmoro/status/2099925214339727646
- **News Report:** hxxps[://]thehackernews[.]com/2026/09/active-exploitation-attempts-target.html