CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 65%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives40
- Confidence55
CVE-2026-5430 lets a token signed with an algorithm WSO2 does not support pass authentication as an administrator. watchTowr says tokens with administrator privileges baked in reached its honeypots on September 13.
Reality
- Evidence68
- Adoption20
- Hype gap+25
- Incentives45
- Confidence65
buildConfirmed2 publishers WSO2 published the fix in May. watchTowr saw forged tokens arrive at its honeypot in September. Its own replay against a correctly targeted deployment came back with the credentials the gateway holds.
Publishers:dev.to · security.docs.wso2.com Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher Bijira's reset header pinned its rate limit to the clock minute
Setting 5 requests per 60 seconds in Bijira's console took a form field and a dropdown. Working out what the gateway meant by 60 seconds took two corrected conclusions and a header that read 57 where a rolling window would have read 60.
Reality
- Evidence66
- Adoption10
- Hype gap−12
- Incentives32
- Confidence55
buildOne report1 publisher One Mirai variant now proxies, sniffs and spreads: the appliance layer is a pivot, not DDoS fodder
FortiGuard Labs says Evooo1Bot packs SOCKS5 relaying, credential sniffing, SSH spreading and 16 flood modes into one binary across 12 CPU architectures. The tunnel matters more than the flood.
Reality
- Evidence48
- Adoption
- Not scored
- Hype gap+18
- Incentives58
- Confidence42