Critical WSO2 API Manager JWT Flaw Under Active Attack

A critical security flaw in WSO2 API Manager is now being actively exploited in the wild, according to findings from watchTowr. WSO2 API Manager is a platform that sits in front of backend services and checks every API request, and JWT (JSON Web Token) is a small digital pass used to prove who is making a request. The vulnerability, tracked as CVE-2026-5430, has a CVSS score of 9.8 out of 10 in the WSO2 advisory, while watchTowr describes it as a CVSS 10.0 critical bug. It stems from improper verification of a cryptographic signature in the JWT authentication process. Hacktron Team has been credited with discovering and reporting the flaw.

The WSO2 advisory released in May 2026 explains that JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access. In a normal JWT flow, the service checks the signature to confirm the token is genuine. The bug means that if an attacker crafts a token using an unsupported signing algorithm, the service still accepts it, and an attacker can create a token that grants administrator rights without knowing the real key. Successful exploitation may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover. The affected products are WSO2 API Control Plane versions 4.6.0 and 4.5.0, WSO2 API Manager versions 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, and 4.1.0, WSO2 Traffic Manager versions 4.6.0 and 4.5.0, and WSO2 Universal Gateway versions 4.6.0 and 4.5.0.

For community users, fixes are available in two WSO2 pull requests: github.com/wso2/carbon-apimgt/pull/13752 and github.com/wso2/product-apim/pull/14167. For WSO2 Support Subscription Holders, patched update levels have been released: WSO2 API Control Plane 4.6.0 at update level 22 and 4.5.0 at update level 58; WSO2 API Manager 4.6.0 at update level 21, 4.5.0 at update level 57, 4.4.0 at update level 72, 4.3.0 at update level 108, 4.2.0 at update level 197, and 4.1.0 at update level 257; WSO2 Traffic Manager 4.6.0 at update level 21 and 4.5.0 at update level 56; and WSO2 Universal Gateway 4.6.0 at update level 21 and 4.5.0 at update level 57.

watchTowr says the vulnerability is now witnessing active in-the-wild exploitation attempts. Its honeypot network, made of decoy systems placed online to attract and observe attackers, captured JWT tokens arriving on September 13, 2026, with baked-in administrator privileges. Yordan Ganchev, principal threat intelligence specialist at watchTowr, explained that the flaw exists because the service accepts JWT tokens signed with algorithms it does not support and then approves them anyway. In the observed exploitation attempts, the forged JWT token is suspected to be used to gain access to every API backend endpoint and its credentials, consumer keys, and secrets for every registered application.

Ganchev added that the service is, by definition, made to intercept API requests on their way to internal systems. That gives attackers an opportunity to tap and steal sensitive data in transit and to interact with internal services through this "lateral movement-as-a-service" product. Because WSO2 API Manager often sits between public users and internal databases, a successful attacker could reach sensitive customer data or backend services without needing to break into each system separately. In light of active exploitation, users are advised to apply the fixes as soon as possible for optimal protection. For organizations running WSO2 or similar API platforms, a security-first IT and infrastructure partner such as AEU-I can help review exposure and keep update levels current.