WSO2 2026 5328

security.docs.wso2.com • September 16, 2026

JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access.

Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.

The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments . This adjustment reflects that the impact is contained within a single security authority boundary.

Community Users (Open Source) ¶

Apply the relevant fixes to your product using the public fix(es) provided below.

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders ¶

Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.

WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.

WSO2 thanks, Hacktron Team for responsibly reporting the identified issue and working with us as we addressed it.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of WSO2 API Manager Vulnerability CVE-2026-5430 A critical vulnerability, CVE-2026-5430, in WSO2 API Manager is currently being exploited in the wild. The flaw allows JWT authentication to be bypassed when tokens are signed with unsupported algorithms, potentially leading to account takeover. Affected systems include WSO2 API Manager versions 4.1.0 to 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. The vulnerability was first reported by the Hacktron Team and has a CVSS score of 9.8. Active exploitation attempts were detected on September 13, 2026, with forged JWT tokens containing administrative privileges. Users are urged to apply available patches immediately to mitigate risks. The vulnerability was initially addressed in May 2026, but exploitation attempts have surged recently, highlighting the urgency for updates. 3 sources 80

Extracted Entities

WSO2 2026 5328

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)