Attackers are actively exploiting a critical authentication-bypass flaw in WSO2’s API management stack, according to new findings from watchTowr. CVE-2026-5430 (CVSS 9.8) lets an unauthenticated attacker forge JWTs that WSO2’s gateway accepts as if they were validly signed — including tokens that claim administrator privileges.

What happened

WSO2 API Manager’s JWT authentication path is supposed to reject any token signed with an algorithm the gateway doesn’t recognize or support. It doesn’t. Instead of failing closed, the verification logic accepts the token anyway, effectively treating an unverifiable signature as a valid one. An attacker who understands this quirk can hand-craft a JWT, set arbitrary claims — including admin-level roles and scopes — sign it with an algorithm the server won’t actually check, and present it to the API gateway as a legitimate credential.

WSO2 classifies the root cause as improper verification of a cryptographic signature (CWE-347), the same bug family behind classic “alg:none” JWT attacks, but here it’s the unsupported-algorithm path rather than the no-signature path that fails open. The practical result is the same: authentication that’s supposed to gate access to the API control plane can be bypassed entirely, with the attacker choosing their own privilege level.

WSO2 disclosed the flaw as advisory WSO2-2026-5328 back in May 2026, credited to Hacktron Team, and shipped patches at the time. What changed this week is exploitation: watchTowr’s honeypot network began capturing inbound JWTs with forged administrator claims on September 13, 2026 — the first confirmed evidence that attackers have operationalized the bug against internet-facing deployments, roughly four months after the patch shipped.

Affected versions and fix

The flaw spans WSO2’s core API management components:

  • WSO2 API Manager: 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
  • WSO2 API Control Plane: 4.5.0, 4.6.0
  • WSO2 Traffic Manager: 4.5.0, 4.6.0
  • WSO2 Universal Gateway: 4.5.0, 4.6.0

Fixed builds:

  • WSO2 API Control Plane 4.5.0.58
  • WSO2 API Manager 4.1.0.257 (and corresponding fixes on later 4.x lines)
  • WSO2 Carbon API Manager REST API Utility 9.20.74.401
  • WSO2 Traffic Manager 4.5.0.56
  • WSO2 Universal Gateway 4.5.0.57

WSO2 published the fix as a public patch against carbon-apimgt (PR #13752), so the code change has been visible and diffable since May — which lowers the bar for anyone reverse-engineering an exploit from the patch itself, a pattern that shows up repeatedly once a months-old fix suddenly starts seeing live attack traffic.

Impact

WSO2 API Manager sits at the front door of an organization’s API traffic — it’s the component deciding which callers get through to backend services and with what privileges. A forged admin JWT doesn’t just leak data from one endpoint; it hands the attacker the same control-plane access a legitimate administrator has: creating or modifying API definitions, managing subscriptions and applications, and reaching whatever backend services the gateway is trusted to front. In single-tenant deployments WSO2 rates confidentiality, integrity, and availability impact all as High — a full compromise of the gateway’s authority.

Because the attack requires no credentials, no user interaction, and no prior access — just the ability to craft and submit a JWT — any internet-reachable WSO2 API Manager or Universal Gateway instance running an unpatched build is exposed right now.

Mitigation

  • Patch immediately to the fixed build for your product line (API Manager 4.1.0.257 or later, Universal Gateway 4.5.0.57, Traffic Manager 4.5.0.56, API Control Plane 4.5.0.58). Given active exploitation, treat this as an emergency change, not routine patch-cycle work.
  • Hunt for prior compromise. Review gateway authentication logs for JWTs carrying admin-level claims that don’t correspond to your organization’s legitimate token-issuance flow, and check for anomalous API-definition changes, new subscriptions, or configuration edits in your API Manager control plane.
  • Restrict exposure of the API Manager management console and gateway administrative endpoints to trusted networks where possible; don’t rely on JWT validation alone as your only access control layer.
  • Rotate signing keys and any credentials reachable via the control plane if you find evidence of forged-token traffic in your logs.
  • Watch for IOCs from watchTowr’s honeypot research as they’re published — early exploitation activity often expands to broader scanning once a working technique circulates.

No CISA KEV listing had been added at publication time, but a CVSS 9.8 unauthenticated auth bypass with confirmed in-the-wild exploitation against internet-facing API gateways is exactly the profile that tends to escalate fast.

Sources: The Hacker News, WSO2 Security Advisory WSO2-2026-5328, GitHub PR #13752