Executive Summary
A critical vulnerability, tracked as CVE-2026-5430 (CVSS 9.8), has been identified in multiple WSO2 products, including API Manager and Traffic Manager. The flaw stems from improper verification of cryptographic signatures when a JWT is signed using an unsupported algorithm. By exploiting this weakness, attackers can bypass authentication and achieve full account takeover, including administrative access.
Technical analysis from watchTowr confirms active in-the-wild exploitation as of September 2026. Attackers are utilizing forged tokens to access API backend endpoints, retrieve sensitive credentials, and steal consumer keys or secrets. Because these products sit between external requests and internal systems, compromise provides an attacker with a strategic vantage point for data exfiltration and lateral movement.
Organizations using affected WSO2 products (versions 4.1.0 through 4.6.0) should prioritize applying the security updates immediately to mitigate the risk of unauthorized administrative access.