CVE-2026-5430

What is WSO2 API Manager?

WSO2 API Manager is an open-source platform for publishing, securing, throttling and monitoring APIs. A deployment is usually split into a control plane (the publisher and developer portal, where APIs and their credentials are defined), a Universal Gateway that fronts the actual backend services, and a Traffic Manager that enforces rate limits. Larger sites run API Control Plane as a separate product.

That makes it an unusually valuable target. The gateway holds the routing configuration and credentials for every backend service behind it, and the control plane holds the consumer keys and secrets issued to every registered client application. Compromising the management plane does not just yield one application; it yields the keys to whatever sits behind the API estate, which in enterprise deployments is frequently core banking, telecom or government back-office systems.

Overview

CVE-2026-5430 is an authentication bypass in the JWT handling used across WSO2's API management products. A token signed with an algorithm the validator does not support is not rejected; the validation path treats the unsupported value as a case it cannot check and lets the token through. An unauthenticated attacker can therefore mint a JWT with administrative claims, present it, and be accepted as an administrator. No credentials, no user interaction and no prior foothold are required, which is why the CVSS 3.1 base score is a full 10.0 (9.8 in single-tenant deployments, where the scope does not change).

WSO2 published advisory WSO2-2026-5328 on 2026-05-03, with patches available shortly before that. The CVE record was not published until 2026-08-06, and exploitation did not appear until September, roughly four months after fixes shipped. On 2026-09-13 watchTowr's honeypot network captured inbound requests carrying pre-forged JWTs with administrator privileges baked in; the finding was made public on 2026-09-16, and CISA added the CVE to the KEV catalog on 2026-09-24 with a three-day remediation deadline.

One inconsistency is worth flagging. The CISA KEV entry describes this as a path traversal leading to unrestricted file upload and remote code execution. The WSO2 advisory and the NVD record (CWE-347, improper verification of a cryptographic signature) both describe a JWT signature-validation bypass, as does every research write-up of the in-the-wild activity. Treat the vendor advisory as authoritative; the KEV summary text appears to be in error, but the affected products, the patch levels and the deadline are unaffected by that.

Affected Versions

Community (non-subscription) users do not receive update levels and must apply the upstream fixes in wso2/carbon-apimgt PR #13752 and wso2/product-apim PR #14167, or migrate to a patched release.

Technical Details

The root cause is CWE-347: the code that verifies a JWT's signature decides what to do based on the alg header value, and on an algorithm it does not recognise it short-circuits out of the verification branch rather than failing closed. The signature is consequently never checked against a trusted key, so the claims inside the token, including administrative role and tenant claims, are accepted at face value.

Attack characteristics are about as bad as they get: network reachable, no authentication, no user interaction, low complexity, and exploitable in a single HTTP request against any listener that performs JWT-based authentication. There is no chaining requirement, and because the forged token is accepted by the management APIs, the attacker inherits the ability to enumerate API definitions and read consumer keys and secrets for every registered application.

Discovery

The vulnerability was reported to WSO2 by the Hacktron Team and credited in advisory WSO2-2026-5328. The in-the-wild exploitation was identified separately by watchTowr, whose honeypot sensors recorded the first attempt on 2026-09-13; watchTowr noted that the attacker initially aimed the payload at the wrong WSO2 product, but researchers confirmed the same request works against the genuinely vulnerable components.

Exploitation Context

Exploitation is confirmed but, on public evidence, still narrow. watchTowr described activity from a single source using forged administrator JWTs, consistent with early-stage reconnaissance or opportunistic scanning rather than mass exploitation. No threat-actor attribution has been published, there are no reports of ransomware use, and no chaining with other CVEs has been described. Reliable internet-exposure counts for vulnerable WSO2 instances have not been published by Shadowserver, Censys or GreyNoise at the time of writing, so the size of the exposed population is unknown.

The gap matters more than the volume: fixes have been available since spring, the flaw is trivially exploitable once known, and the payoff is credentials for every backend behind the gateway. Assume scanning will broaden quickly now that the CVE is in KEV.

Remediation

1. Apply the update level listed above for your exact product and version through WSO2 Updates. Community deployments must apply carbon-apimgt PR #13752 and product-apim PR #14167 or move to a patched release.
2. No vendor workaround exists. If patching cannot happen immediately, restrict network access to the API Control Plane, Publisher and Admin interfaces so they are reachable only from trusted management networks, and keep them off the public internet.
3. Treat any unpatched instance that has been internet-facing since May 2026 as potentially compromised. Review gateway and management-plane logs for successful authentications carrying JWTs with unusual alg header values or administrator claims that do not correspond to a real login.
4. Rotate consumer keys, client secrets and backend credentials held by the deployment if there is any sign of unauthorised access, since those are the assets an attacker would take first.
5. Federal civilian agencies must remediate by 2026-09-27 under the applicable CISA directive; the same deadline is a sensible target for everyone else given how short the window is.