WSO2 API Manager JWT Bypass CVE-2026-5430 Hits CISA KEV Five Months After the Fix

CISA added CVE-2026-5430 to the Known Exploited Vulnerabilities catalog on 24 September 2026, and the story behind it is uncomfortable for anyone running WSO2's API management stack. The fix has been available since May. Attackers are now sending forged administrator tokens to internet-facing gateways anyway, and federal agencies have until 27 September to remediate. If you operate WSO2 API Manager, API Control Plane, Traffic Manager, or Universal Gateway, treat this as a same-day patch and a compromise assessment, not a routine update.

What Happened

WSO2 published security advisory WSO2-2026-5328 on 3 May 2026, rating the flaw Critical with a CVSS 3.1 base score of 10.0 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), adjusted to 9.8 for single-tenant deployments. The vendor's description is short: JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access, including potential compromise of administrative accounts. The CVE record, which WSO2 issued as the CVE Numbering Authority, was published on 6 August 2026 under the title "Authentication BypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover" and carries CWE-347, improper verification of a cryptographic signatureCryptographic Signature📖A mathematical scheme that uses public key cryptography to verify the authenticity and integrity of digital data, ensuring the content has not been altered and was created by the claimed sender.. Credit for the discovery goes to the Hacktron team.

Nothing public happened for four months. Then on 13 September, watchTowr's honeypotHoneypot🛡️A decoy system deployed to be attacked so defenders can observe exploitation attempts safely. Honeypot networks give early warning that a vulnerability has moved from theoretical to actively exploited, often before official catalogs like CISA KEV confirm it. network recorded the first exploitation attempt. According to the firm's principal threat intelligence specialist, Yordan Ganchev, speaking to SecurityWeek, the attacker sent a forged JSON Web Token with administrator privileges baked in. The attacker aimed it at the wrong product in the honeypot fleet, so the attempt failed, but watchTowr replayed the same payload against the correct target and confirmed the bypass works. The firm's assessment of the attacker's goal is blunt: the forged token yields access to every API backend endpoint the gateway fronts, along with the credentials, consumer keys, and secrets for every registered application. The Hacker News reported watchTowr's findings on 16 September and, citing the firm, noted that WSO2 serves nearly a thousand customers across banking, government, telecommunications, and logistics.

Eleven days after that first honeypot hit, CISA listed the bug in KEV with a three-day federal deadline.

Who Is Affected

The vendor advisory lists four products and the exact update levels that carry the fix:

• WSO2 API Manager 4.1.0 through 4.6.0. Fixed at update levelUpdate Level🛡️A vendor patch-numbering scheme in which fixes are applied incrementally on top of a fixed base version, so two nodes reporting the same version can differ in which security fixes they carry. WSO2 publishes the update level that carries each fix; inventories must track it per node. 257 (4.1.0), 197 (4.2.0), 108 (4.3.0), 72 (4.4.0), 57 (4.5.0), and 21 (4.6.0).
• WSO2 API Control Plane 4.5.0 and 4.6.0. Fixed at update level 58 and 22 respectively.
• WSO2 Traffic Manager 4.5.0 and 4.6.0. Fixed at update level 56 and 21.
• WSO2 Universal Gateway 4.5.0 and 4.6.0. Fixed at update level 57 and 21.

The CVE record additionally lists the underlying library, the carbon-apimgt REST API utility, as affected from version 9.20.74 through 9.32.147. That matters if you build from source or run a distribution that vendors the library rather than the packaged product.

The update levels are the point of friction. WSO2 delivers fixes to support subscribers through its Updates tooling, so "we are on 4.5.0" tells you nothing about exposure. You need the update level of each node. Community-edition users do not get the updates channel at all. The advisory points them at two public pull requests on GitHub, carbon-apimgt 13752 and product-apim 14167, or an upgrade to an unaffected release. Organizations that assume open-source deployments patch themselves the way commercial ones do are the ones most likely to still be exposed in September.

Technical Analysis

The merged fix in carbon-apimgt is instructive because it is small. The pull request, titled "Improve exception handling" and merged to the master branch on 12 April 2026, touches four files: the JWT utility class, the OAuthOAuth🛡️An open standard authorization protocol that allows applications to access user resources without exposing passwords, using tokens instead of credentials. authentication interceptor, a new interceptor exception type, and the global throwable mapper. The behavioral change is that the JWT verification path now throws an invalid-access-token error when it encounters an unsupported RSA algorithm, and the interceptor that wraps authentication now propagates that error instead of suppressing it. In other words, before the fix, a token whose algorithm the verifier did not recognize could fall through the signature check without a hard rejection, and the caller was never told. That is the textbook shape of an algorithm confusion attackAlgorithm Confusion Attack🛡️A JWT attack in which the verifier lets the token's header decide which algorithm to verify with, or fails to reject an algorithm it does not support, so an attacker-signed token passes the signature check. It is the class of bug behind the WSO2 API Manager bypass CVE-2026-5430., the class of JWT weakness explained in How JWT Algorithm Confusion Lets a Forged Token Pass Signature Checks.

The consequence is that the attacker does not need a stolen key, a leaked token, or a valid account. They mint a JWT, populate its claims with an administrator identity, set an algorithm the verifier mishandles, and present it as a bearer tokenBearer Token🛡️A credential presented in an HTTP Authorization header that grants access to whoever holds it, with no proof of identity beyond possession. Services must validate the token on every request; a code path that accepts any bearer value, as in CVE-2026-59822, is an authentication bypass.. No user interaction, no prior privileges, and network reachability is the only precondition, which is why the vector scores 10.0.

There is a discrepancy in the public record worth flagging. CISA's KEV entry is titled "WSO2 Multiple Products Path TraversalPath Traversal🛡️A web vulnerability (CWE-22) where user-supplied input in a file path escapes the directory the application intended to serve from, typically via parent-directory references, letting an attacker read or write files elsewhere on the server. VulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm." and describes a path traversal that allows unrestricted file upload leading to remote code execution. That does not match the vendor advisory, the CVE record WSO2 authored, watchTowr's observed payloads, or the merged code change, all of which describe a JWT signature-verification bypass. The KEV entry's own CWE tag, CWE-347, matches the JWT explanation rather than path traversal. This article follows the primary sources. It is possible CISA is describing a post-authentication file-upload path an attacker can reach once they hold a forged admin token, but nothing published so far supports that chain, so treat the KEV wording as a labeling error until CISA or WSO2 clarifies. CVSS reporting also differs: WSO2 and the CVE record say 10.0, several outlets quote the single-tenant 9.8 figure.

Immediate Actions

**Inventory by update level, not version.** Pull the update level from every API Manager, Control Plane, Traffic Manager, and Universal Gateway node and compare against the table above. Include non-production and partner-facing instances; the honeypot attacker was clearly scanning broadly.

**Patch or take it off the network.** Support subscribers apply the listed update level through WSO2 Updates. Community users apply the two referenced pull requests or move to an unaffected release. CISA's required action under BOD 26-04BOD 26-04🛡️CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier. is explicit that if mitigation is unavailable, the product should be removed from service.

**Assume compromise on any node that was exposed and unpatched.** The KEV entry sets the forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs. flag, which means BOD 26-04 requires federal agencies to investigate whether the system was compromised before patching. Everyone else should do the same. The observable artifact is an administrator-scoped session with no corresponding login at your identity provider, and a bearer token whose algorithm header is not one your deployment issues. How to Hunt for Forged Admin Tokens in API GatewayAPI Gateway🛡️A reverse proxy that sits in front of backend services, authenticating clients, enforcing rate limits and policy, and routing requests. Because it registers every client and stores every backend definition, an administrator on the gateway can reach credentials for everything it fronts. Logs walks through where those artifacts land and how to query for them. Start the window at 13 September and extend backward if your environment suggests earlier scanning.

**Rotate what the gateway holds.** If there is any sign of a forged token being accepted, consumer keys and secrets for every registered application, backend credentials stored in the gateway, and any keystores the admin console can export should be treated as exposed. The guide After a FirewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. Breach, Assume Every Stored Credential Is Compromised applies word for word to an API gateway.

The Other KEV Addition

CISA listed a second bug in the same batch: CVE-2026-71362, an incorrect-authorization flaw in Adobe Commerce and Magento with the same 27 September deadline. Adobe fixed it on 11 August in bulletin APSB26-92 and stated at the time it was not aware of in-the-wild exploitation. Sansec, which analyzed the patch, said the flaw lets an attacker switch a customer session to another customer's account with no existing account, administrator privileges, or user interaction, and it began blocking exploitation attempts in August. The Hacker News, citing Previdian telemetry, reported a single Australian IP attempting exploitation on 10 September. The flaw carries a CVSS score of 9.1 per SecurityWeek. It affects all Commerce, Commerce B2B, and Magento Open SourceOpen Source📖Software with publicly available source code that anyone can inspect, modify, and distribute. versions up to and including the July 2026 patches, and the fix ships as an isolated patch that requires the latest point release for your branch first.

Long-Term Outlook

Two things stand out. First, this is another entry in the growing list of flaws exploited months after a fix shipped, not days. The window between advisory and exploitation was over four months, and the tooling that eventually arrived was a pre-built admin token, not a memory-corruption exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access.. That points at a scanning actor who read a public advisory, worked out the bypass without a public proof of concept, and started spraying. Vendors that ship fixes as update levels with terse descriptions are not buying their customers silence; they are buying them time, and that time ran out.

Second, an API management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. is a credential vault whether or not you think of it that way. The gateway holds the keys to everything behind it. Why an API Management Plane Is a Credential Vault for Every Backend It Fronts lays out why these systems deserve the same tiering and monitoring as the identity provider they usually sit next to, and the earlier piece Why the Server That Issues Your Access Tokens Is a Tier-0 Asset makes the same case for the OAuth server one hop upstream. The BOD 26-04 forensic-triage requirement exists because a bypassed login on this kind of system is rarely the end of the intrusion.

Sources

• CISA Known Exploited Vulnerabilities feed (entries dated 2026-09-24): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, "CISA Adds Two Known Exploited Vulnerabilities to Catalog," 24 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
• WSO2 Security Advisory WSO2-2026-5328 / CVE-2026-5430: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
• CVE record for CVE-2026-5430 (WSO2 as CNA): https://www.cve.org/CVERecord?id=CVE-2026-5430
• carbon-apimgt pull request 13752 (the merged fix): https://github.com/wso2/carbon-apimgt/pull/13752
• The Hacker News, "WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines.," 25 September 2026: https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html
• The Hacker News, "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens," 16 September 2026: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
• SecurityWeek, "Enterprises Warned of Attacks Exploiting WSO2 Vulnerability": https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/
• SecurityWeek, "Adobe Commerce Bug Targeted Immediately After Disclosure," 13 August 2026: https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/
• BleepingComputer, "Hackers exploit critical Adobe Commerce flaw to hijack customer accounts," 12 August 2026: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
• Inception Security, "Hunt WSO2 CVE-2026-5430: JWT auth bypass," 16 September 2026: https://www.inceptionsecurity.com/post/hunt-wso2-jwt-auth-bypass