WSO2 API Manager JWT Bypass Exploitation

A critical security vulnerability, tracked as CVE-2026-5430 (CVSS 9.8/10.0), is currently under active exploitation by unidentified threat actors targeting WSO2 infrastructure. The flaw stems from improper cryptographic signature verification where the system incorrectly validates JSON Web Tokens (JWT) signed with unsupported algorithms.

Technically, attackers are forging JWTs with baked-in administrator privileges to bypass authentication mechanisms. This allows them to obtain sensitive credentials, consumer keys, and secrets for registered applications. As these WSO2 products act as gateways, successful exploitation provides a platform for 'lateral movement-as-a-service,' enabling data theft in transit and access to internal backend services.

This activity poses an extreme risk to organizations using WSO2 API Manager, Control Plane, Traffic Manager, or Universal Gateway versions 4.1.0 through 4.6.0. Immediate patching is required as exploitation has been confirmed in the wild as of September 2026.