Critical Authentication Bypass in WSO2 API Management Products Under Active Exploitation (CVE-2026-5430)

Executive Summary

On September 24^th, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability in WSO2 API management products to its Known Exploited Vulnerabilities (KEV) catalog following confirmed exploitation in the wild. Tracked as CVE-2026-5430 and recently updated to a CVSS score of 10, the flaw lets an unauthenticated remote attacker forge a JSON Web Token (JWT) that bypasses authentication, allowing access to administrative accounts. It affects the WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. WSO2 released fixes ahead of the exploitation.

Active exploitation is confirmed. Honeypot sensors captured forged administrator tokens targeting the flaw beginning September 13th, 2026, and CISA has since added it to the KEV catalog. Given the unauthenticated remote access it grants to internet-reachable API infrastructure, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.

Affected Systems or Products

Mitigations / Workarounds

A single upgrade remediates the flaw for each affected product. There is no configuration setting that disables the vulnerable behavior, so patching and network containment are the priority.

Open-source Users:

Apply the public code fixes in the Carbon API Management and Product APIM repositories or migrate to the latest unaffected release of the affected product.

Support Subscription Holders:

Apply the vendor-specified update level for your version, or a newer one:

API Control Plane:  

• 4.6.0 update level 22
• 4.5.0 update level 58

API Manager:

• 4.6.0 update level 21
• 4.5.0 update level 57
• 4.4.0 update level 72
• 4.3.0 update level 108
• 4.2.0 update level 197
• 4.1.0 update level 257

Traffic Manager:

• 4.6.0 update level 21
• 4.5.0 update level 56

Universal Gateway:

• 4.6.0 update level 21
• 4.5.0 update level 57

Besides performing the updates, organizations running WSO2 should mitigate risk of attackers gaining access to their infrastructure:

1. Restrict access to internet-facing WSO2 management consoles and gateways to trusted administrative networks until updates are applied.
2. Because a forged token exposes application credentials, rotate consumer keys, secrets, and administrative credentials, and review administrator accounts for unauthorized additions or changes.

Patches

WSO2 has released fixes for all affected products. Open-source users receive the fix through public code changes, while support subscription holders apply the vendor-provided update levels. Full details are available in the official WSO2 security advisory (WSO2-2026-5328).

Indicators of Compromise

On September 24th, 2026, CISA added CVE-2026-5430 to its KEV catalog, confirming active exploitation in the wild. watchTowr reported that its honeypot network captured forged JWTs carrying administrator privileges beginning September 13th, 2026.

Defenders should inspect authentication logs for anomalous JWT validation events, such as tokens accepted despite being signed with an unexpected or unsupported algorithm, and successful authentications that do not correspond to a legitimate login.

This can be searched from the WSO2 install ./repository/logs/http_access_*.log for HTTP 200 responses to

• ‍/api/am/admin/
• /api/am/publisher/
• /api/am/devportal/

Organizations should also monitor for newly created or newly privileged administrator accounts; changes to API configurations, routing, or access policies; and administrative activity originating from unfamiliar addresses. Because a forged token yields application credentials and secrets, treat any unexplained use of consumer keys or back-end service credentials as a potential sign of compromise.

Technical Details

CVE-2026-5430 is a signature verification flaw in how WSO2 API management products handle JSON Web Token authentication. The software accepts a token to the endpont /api/am/admin/ signed with an algorithm it does not support and incorrectly treats that token as validly signed. An attacker can therefore craft a JWT that asserts any identity, including an administrator, without possessing a legitimate signing key and present it to bypass authentication entirely. No credentials or user interaction is required. WSO2 credits the Hacktron Team with discovering and reporting the issue.

watchTowr's intel platform reported the in-the-wild activity and observed forged tokens minted with administrator privileges. watchTowr reported that a forged token grants access to every API back-end endpoint, along with the credentials, consumer keys, and secrets of every registered application.

Full technical write-ups and a public proof-of-concept for this WSO2 flaw were not available at the time of publication.

How Beazley Security is Responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• ‍https://nvd.nist.gov/vuln/detail/CVE-2026-5430 ‍
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ‍
• https://thehackernews.com/2026/09/active-exploitation-attempts-target.html ‍
• https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog