Attackers are now exploiting a critical WSO2 software flaw that can let them break into enterprise API systems and access sensitive data. WatchTowr says CVE-2026-5430, a CVSS 10.0 bug patched by WSO2 in April and described in a May advisory, allows JSON Web Token (JWT) authentication bypass through an unsupported signing algorithm. Affected products include WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway, where forged tokens can expose backend API endpoints, credentials, consumer keys, secrets, and potentially enable access to internal services.
Why it matters: Organizations using affected WSO2 products should treat this as urgent because attackers can bypass login protections and gain broad visibility into API traffic and secrets. Patch immediately, review internet exposure, rotate exposed credentials and keys, and check logs for forged JWT-based access attempts.
Bill Toulas
2026.09.25
95% relevant
This article adds that CISA has now added CVE-2026-5430 to the KEV catalog, set a September 27 federal remediation deadline, and notes observed exploitation attempts referenced by watchTowr.
Eduard Kovacs
2026.09.16
100% relevant
This article establishes a new tracked story by providing the first cited evidence that CVE-2026-5430 in WSO2 products is being exploited in the wild, with concrete details on attacker behavior and the affected product set.
← Back to all stories