WSO2 API Manager/Traffic Manager JWT alg=none Authentication Bypass (CVE-2026-5430)

Arnold Chan@slaz

•updated Sep 16, 2026•1•0•4

Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.