- Published on
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
- Authors
- Name
- DeepHorus
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
Active exploitation attempts are now targeting a critical authentication bypass in WSO2 API Manager, a widely deployed enterprise API management platform. The flaw, tracked as CVE-2026-5430 and rated 9.8 out of 10 on the CVSS scale, allows attackers to forge JSON Web Tokens (JWTs) with administrator privileges and bypass authentication entirely. Security firm watchTowr said its honeypot network captured malicious tokens on September 13, 2026, confirming that real-world attackers are already probing and exploiting the vulnerability. The development matters because WSO2 API Manager often sits at the center of an organization's API traffic, making a successful compromise a direct path to sensitive backends, credentials, and internal services.
WSO2 disclosed the issue in May 2026 and credited the Hacktron Team with discovering and reporting it. According to the vendor advisory, JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access. Successful exploitation may lead to administrative account compromise and full account takeover. The vulnerability affects multiple WSO2 products, including API Manager versions 4.1.0 through 4.6.0, API Control Plane 4.5.0 and 4.6.0, Traffic Manager 4.5.0 and 4.6.0, and Universal Gateway 4.5.0 and 4.6.0. Patches are available through community pull requests and subscription update levels, but unpatched systems remain at risk.
watchTowr's principal threat intelligence specialist, Yordan Ganchev, said the defect exists because the service accepts JWTs signed with algorithms it does not support and then approves them anyway. That design failure turns a routine JWT validation step into a complete authentication bypass. In observed attacks, the forged tokens carry baked-in administrator privileges. Attackers are suspected of using these tokens to access every API backend endpoint, along with consumer keys, secrets, and credentials for every registered application. Because WSO2 API Manager is designed to intercept API requests traveling to internal systems, it becomes an ideal position for stealing data in transit and interacting with internal services.
Technically, the flaw is a classic algorithm confusion and improper signature verification problem. A secure JWT implementation must reject tokens whose 'alg' header specifies an unsupported or unexpected algorithm, including 'none' or asymmetric algorithms improperly downgraded to symmetric ones. In this case, WSO2 API Manager failed to enforce that validation and accepted the forged token as legitimate. Once accepted, the token's claims, including administrative roles, are trusted by the platform. That means an attacker does not need valid credentials, a session, or a password reset; they only need to craft a token that the vulnerable service will incorrectly approve. The result is immediate, high-privilege access to API management functions and potentially to every protected API behind the gateway.
The implications are severe for both short-term incident response and long-term security architecture. In the short term, compromised organizations face unauthorized API access, data exfiltration, credential theft, and lateral movement into internal systems. Consumer keys and secrets exposed through the API Manager could be used to impersonate legitimate applications, bypass rate limits, or abuse partner integrations. In the longer term, the incident reinforces the danger of treating API gateways as trusted black boxes. These platforms aggregate enormous amounts of authentication material and network reach, so a single cryptographic validation error can undermine an entire API ecosystem. Regulated industries may also face breach notification and compliance consequences if sensitive data is accessed.
Reactions from the security community have been urgent. watchTowr described the bug as critical and warned that exploitation is not theoretical. WSO2 has published advisory guidance and released fixes for supported versions, including specific update levels for subscription holders and public pull requests for community users. Security practitioners are urging organizations to patch immediately, hunt for forged or anomalous JWTs, rotate exposed secrets, and review API Manager logs for unexpected administrative actions. Some researchers noted a scoring discrepancy, with the vendor advisory listing CVSS 9.8 while watchTowr characterized the impact as effectively 10.0, reflecting how completely the flaw can compromise a target.
The outlook is likely to include continued scanning and exploitation against unpatched WSO2 instances. Attackers frequently weaponize critical authentication bypasses within days or weeks of public proof-of-concept details, and honeypot evidence suggests this campaign is already active. Organizations should prioritize updating to the fixed update levels for API Manager, API Control Plane, Traffic Manager, and Universal Gateway. If immediate patching is impossible, teams should isolate management interfaces, restrict network access, and closely monitor authentication events. In the longer term, vendors and developers must ensure JWT libraries reject unsupported algorithms by default. Until then, WSO2 API Manager users should assume forged admin tokens are a live threat and act accordingly.
