Hackers Actively Exploit a Critical WSO2 API Manager Flaw to Forge Admin Tokens

Security researchers at watchTowr say a critical vulnerability in WSO2 API Manager, tracked as CVE-2026-5430 with a maximum-severity 9.8 CVSS score, is now being actively exploited in the wild — with the firm's honeypot network capturing forged JWT tokens carrying baked-in administrator privileges as early as September 13.

The flaw is an improper verification of a cryptographic signature: authentication can be bypassed entirely when a JSON Web Token is signed using an algorithm the server doesn't properly validate, letting an attacker forge a token that the system accepts as a legitimate admin session. Hacktron Team is credited with originally discovering and reporting the issue.

A successful forgery hands an attacker access to every API backend endpoint behind the gateway, along with the consumer keys and secrets for every registered application — effectively a full account takeover of the API management layer. The vulnerability affects API Manager versions 4.1.0 through 4.6.0, plus the API Control Plane, Traffic Manager, and Universal Gateway components; organizations running affected versions are urged to patch immediately.

Photo via Wikimedia Commons, © Microbiz Mag, licensed under CC BY 2.0.