Critical WSO2 API Manager Vulnerability Allowing Admin-Token Forgery Is Already Being Exploited

A critical vulnerability in WSO2 API Manager has been weaponized by attackers — as reported by the company watchTowr. The flaw has been assigned the identifier CVE-2026-5430 and a score of 9.8 on the CVSS scale (watchTowr's commentary also cites the maximum score of 10.0). The issue was discovered and disclosed by the Hacktron Team.

The heart of the problem

The bug lies in the mechanism for verifying cryptographic signatures. As explained in WSO2's May 2026 advisory, JWT authentication can be bypassed if the token is signed with an algorithm the service does not support: the system accepts such a token and approves it anyway. This makes unauthorized access possible, up to and including the full takeover of administrative accounts.

Several of the vendor's products are affected at once: WSO2 API Manager versions 4.1.0 through 4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.

The attacks are already underway

According to watchTowr, their network of honeypots began intercepting malicious JWT tokens with embedded administrator privileges as early as September 13, 2026. “It's easy to see why this is a critical bug,” noted Jordan Ganchev, watchTowr's lead threat analyst.

The researchers suspect that a forged token grants access to all backend API endpoints and their credentials, as well as to the keys and secrets of every registered application. Ganchev draws attention to the particular danger posed by this class of products specifically: an API gateway, by its very nature, intercepts requests on the way to internal systems. This gives an attacker a prime opportunity to eavesdrop on and steal data in transit and to interact with internal services — a kind of “lateral movement as a service.”

What to do

Fixes are already available. Users of the community editions have been offered corresponding pull requests in the carbon-apimgt and product-apim repositories, while holders of a WSO2 support subscription have been issued updates with a specific update level for each product version. Given the active exploitation, it is recommended that patches be applied as soon as possible.

Source: The Hacker News