Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical vulnerability, CVE-2026-5430, in WSO2 API Manager and related products is under active exploitation, allowing attackers to bypass JWT authentication by using forged tokens signed with unsupported algorithms. This flaw enables unauthorized access, including compromise of administrative accounts and full account takeover. Exploitation attempts have been observed in the wild, with honeypots detecting forged JWT tokens granting administrator privileges as of September 13, 2026. The vulnerability affects multiple versions of WSO2 products, and immediate patching is advised.

AI-extracted · verify before operational use