Forged admin JWTs are landing on WSO2 API Manager four months after the fix shipped
CVE-2026-5430 lets a token signed with an algorithm WSO2 does not support pass authentication as an administrator. watchTowr says tokens with administrator privileges baked in reached its honeypots on September 13.
The Watch · Security desk
What happened
- CVE-2026-5430 is an improper cryptographic signature verification flaw in WSO2 API Manager, scored 9.8 out of 10.0, that can end in account takeover.
- It affects API Manager 4.1.0 through 4.6.0, plus versions 4.5.0 and 4.6.0 of WSO2 API Control Plane, Traffic Manager and Universal Gateway.
- watchTowr says its honeypot network captured JWT tokens with administrator privileges baked in arriving on September 13, 2026, which it calls active in-the-wild exploitation attempts.
- WSO2 has released the fix to support subscription holders as numbered update levels, reaching update level 257 for API Manager 4.1.0.
Why it matters
- What it costs cost Community users take the fix from pull requests, so the change lands as a source build and redeploy of the gateway; support subscription holders apply an update level. Same CVE, two different work packages.
- Who has to decide decision Operators of internet-facing gateways that were behind on update levels now have to decide whether to rotate consumer keys and secrets on the assumption a forged token already read them.
- What doesn't add up contradiction The advisory carries a 9.8 score while watchTowr's Ganchev calls it a CVSS 10.0 bug. The gap changes nothing about patch order, but it tells you the public severity record is not settled.
Next story · Security · Sep 25
CISA lists WSO2's forged-token bypass as exploited on thin public evidenceConfirmed4 publishers
Signature validation that fails open is the whole bug. "The flaw exists in the service due to how JWT authentication accepts tokens signed with algorithms it does not support, then approves them anyway," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News [5]. WSO2 describes the same behaviour in its advisory: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access" [2]. The vendor added that successful exploitation "may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover" [1].
The evidence for exploitation is honeypot traffic. watchTowr's network captured tokens with administrator privileges already inside them [4]. What an attacker did after that is inference: Ganchev said the forged token is suspected to give access to every API backend endpoint and its credentials, along with consumer keys and secrets for every registered application [6]. watchTowr's account does not name a compromised production deployment.
An API gateway sits in the traffic path by design. "The service is also by definition made to intercept API requests on their way to internal systems, which provides a great opportunity to tap and steal sensitive data in transit and interact with internal services through this 'lateral movement-as-a-service' product," Ganchev said [7].
The published fixes cover twelve product and version combinations [13]. On the 4.6.0 branch the fix is update level 21 for API Manager, Traffic Manager and Universal Gateway, and update level 22 for API Control Plane [9][10]. Older API Manager branches carry higher numbers: 197 for 4.2.0, 108 for 4.3.0, 72 for 4.4.0 [9]. API Control Plane, Traffic Manager and Universal Gateway are listed as affected only at 4.5.0 and 4.6.0, so a gateway estate can need two different remediation paths depending on which components are deployed [3].
Roughly four months separate the advisory from the first captured tokens [12]. Hacktron Team is credited with finding and reporting the flaw [8].
What to watch
- Whether a WSO2 customer reports credential theft matching the impact watchTowr describes as suspected.
- Whether the September 13 token traffic resolves to a single actor or to broad commodity scanning.
- Whether WSO2 adds product versions to the affected list beyond the 4.1.0 to 4.6.0 range already published.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption20
- Hype gap+25
- Incentives45
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
WSO2 released the advisory in May 2026 and stated: "Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover."
- [2]
WSO2 advisory: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access."
- [3]
Affected products are WSO2 API Control Plane 4.6.0 and 4.5.0; WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0 and 4.1.0; WSO2 Traffic Manager 4.6.0 and 4.5.0; and WSO2 Universal Gateway 4.6.0 and 4.5.0.
- [4]
According to watchTowr, the vulnerability is witnessing active in-the-wild exploitation attempts, with its honeypot network capturing JWT tokens arriving on September 13, 2026 with baked-in administrator privileges.
- [5]
"The flaw exists in the service due to how JWT authentication accepts tokens signed with algorithms it does not support, then approves them anyway," said Yordan Ganchev, principal threat intelligence specialist at watchTowr, in a statement shared with The Hacker News.
- [6]
In the observed exploitation attempts, the forged JWT token is suspected to be used to gain access to every API backend endpoint and its credentials, consumer keys, and secrets for every registered application, according to Ganchev.
- [7]
Ganchev said: "The service is also by definition made to intercept API requests on their way to internal systems, which provides a great opportunity to tap and steal sensitive data in transit and interact with internal services through this 'lateral movement-as-a-service' product."
- [8]
Hacktron Team has been credited with discovering and reporting the flaw.
- [9]
Fixes are available in pull requests for community users, and have been released for WSO2 Support Subscription Holders at these update levels: API Manager 4.6.0 update level 21, 4.5.0 update level 57, 4.4.0 update level 72, 4.3.0 update level 108, 4.2.0 update level 197, 4.1.0 update level 257.
- [10]
Update levels for the other products: API Control Plane 4.6.0 update level 22 and 4.5.0 update level 58; Traffic Manager 4.6.0 update level 21 and 4.5.0 update level 56; Universal Gateway 4.6.0 update level 21 and 4.5.0 update level 57.
- [11]
In light of active exploitation, users are advised to apply the fixes as soon as possible.
- [12]
About four months separate WSO2's May 2026 advisory from the September 13, 2026 honeypot captures.
- [13]
WSO2 published update-level fixes for twelve product and version combinations.
- [14]
CVE-2026-5430 is a critical flaw in WSO2 API Manager involving improper verification of a cryptographic signature that could result in account takeover, with a CVSS score of 9.8 out of 10.0.
- [15]
Ganchev said: "So, it's easy to see why this is a critical bug (CVSS 10.0). It affects API Manager 4.1.0 through 4.6.0, API Control Plane, Traffic Manager and Universal Gateway."
Sources
2 independent publishers whose own reporting we read for this story.
- securityweek.comEnterprises Warned of Attacks Exploiting WSO2 Vulnerability
2 articles · September 17, 2026
- thehackernews.comActive Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
2 articles · September 16, 2026
Topics and entities
Topics
- API gateway security
- Authentication Bypass Flaws
- Actively Exploited Vulnerabilities and KEV Mandates
Entities
- WatchTowr
- Hacktron
- WSO2 API Manager
- WSO2
- JSON Web Token