{"id":"wso2-api-manager-jwt-bypass-sep-2026","category":"patch","status":"live","title":"WSO2 API Manager and gateway products: login bypass CVE-2026-5430 used in attacks; update levels available","tldr":"WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway have a CVSS 10 flaw (CVE-2026-5430) that lets attackers forge admin tokens. It is being used in attacks. Business IT teams should apply WSO2's May 2026 fixes and rotate credentials. Nothing for home users.","summary":"CVE-2026-5430 is a critical flaw in several WSO2 products used to run and secure business software connections (APIs). WSO2's own advisory, published 3 May 2026, says the products can accept a login token (a JWT) signed with an unsupported method, so an attacker can get in without valid credentials and may take over administrator accounts. It is rated CVSS 10, or 9.8 for single-tenant setups. Field Effect reports researchers first saw an attack attempt on 13 September, a forged admin token sent to a decoy system, and disclosed it on 16 September. CISA added the flaw to its list of exploited vulnerabilities on 24 September. Sources disagree on the type: CISA's entry says path traversal leading to code execution, while WSO2 and the reports describe a token-signature bypass. WSO2's advisory does not mention path traversal. WSO2 fixes exist for every affected version, as update levels for support subscribers and public code changes for open-source users. No workaround is offered. This affects businesses, not home devices.","action":"If your business runs WSO2 API Manager or related gateways, ask your IT team or WSO2 support to apply the update level in advisory WSO2-2026-5328 or higher. They should also review admin activity and rotate API credentials and keys.","product":"WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-5430"],"tags":["wso2","api-manager","jwt","authentication-bypass","cisa-kev","exploited","enterprise"],"affected":["WSO2 API Control Plane 4.6.0, 4.5.0","WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0","WSO2 Traffic Manager 4.6.0, 4.5.0","WSO2 Universal Gateway 4.6.0, 4.5.0"],"fixed":["API Control Plane 4.6.0 update level 22; 4.5.0 update level 58","API Manager 4.6.0 level 21; 4.5.0 level 57; 4.4.0 level 72; 4.3.0 level 108; 4.2.0 level 197; 4.1.0 level 257","Traffic Manager 4.6.0 level 21; 4.5.0 level 56","Universal Gateway 4.6.0 level 21; 4.5.0 level 57","Community users: public code fixes carbon-apimgt pull request 13752 and product-apim pull request 14167"],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory WSO2-2026-5328 / CVE-2026-5430","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","by":"WSO2","date":"2026-05-03"},{"kind":"research","title":"Exploitation of WSO2 authentication bypass (CVE-2026-5430)","url":"https://fieldeffect.com/blog/exploitation-wso2-authentication-bypass","by":"Field Effect","date":"2026-09-17"},{"kind":"news","title":"U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/199704/hacking/u-s-cisa-adds-adobe-and-wso2-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-09-25"}],"started":"2026-09-24","closed":null,"created":"2026-11-03T22:07:20.176Z","updated":"2026-11-03T22:07:20.176Z","cve_notes":[{"cve":"CVE-2026-5430","name":"Token-signature login bypass in WSO2 API products","what":"WSO2's API Manager, API Control Plane, Traffic Manager and Universal Gateway can accept a login token signed with an unsupported algorithm, letting an attacker forge an admin token and take over accounts; CISA's listing instead describes path traversal leading to code execution, and sources disagree.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-09-24","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities list. Its entry calls the flaw a path traversal, while other reports and the NVD-based descriptions call it a token-signature authentication bypass. US federal agencies were told to fix it by 27 September.","url":"https://securityaffairs.com/199704/hacking/u-s-cisa-adds-adobe-and-wso2-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","patch":null},{"at":"2026-09-16","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"Researchers publicly disclosed the exploitation attempts. Field Effect's 17 September write-up says attackers forge administrator tokens to take over admin accounts, which could expose API settings, credentials and secrets.","url":"https://fieldeffect.com/blog/exploitation-wso2-authentication-bypass","by":"Field Effect","patch":null},{"at":"2026-09-13","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"Researchers say they first saw an exploitation attempt on 13 September: a forged administrator token sent to a research honeypot (a decoy system).","url":"https://fieldeffect.com/blog/exploitation-wso2-authentication-bypass","by":"Field Effect","patch":null},{"at":"2026-05-03","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"WSO2 published advisory WSO2-2026-5328 for CVE-2026-5430, a critical flaw (CVSS 10) in API Manager, API Control Plane, Traffic Manager and Universal Gateway. It lists update levels for subscribers and public code fixes for community users, and credits the Hacktron Team. It makes no statement about attacks.","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","by":"WSO2","patch":"partial"}],"url":"https://hard.fyi/live/wso2-api-manager-jwt-bypass-sep-2026/","json":"https://hard.fyi/api/live?id=wso2-api-manager-jwt-bypass-sep-2026"}