Attackers began probing WSO2's JWT bypass 133 days after the fixes went out
WSO2 published the fix in May. watchTowr saw forged tokens arrive at its honeypot in September. Its own replay against a correctly targeted deployment came back with the credentials the gateway holds.
The Engineer · Build desk
What happened
- WSO2's advisory for CVE-2026-5430, published on May 3 and scored CVSS 10, says JWT authentication can be bypassed when a token is signed using an unsupported algorithm, leading to full account takeover.
- The affected list covers WSO2 API Manager at six versions from 4.1.0 to 4.6.0, plus API Control Plane, Traffic Manager and Universal Gateway at 4.5.0 and 4.6.0.
- watchTowr observed initial exploitation attempts on September 13, and in its honeypot network the attacker sent the forged JWT to the wrong product, where the bypass was not reported as successful.
- Replaying the same payload against the correct target product gave the researchers API backend destinations, credentials, and the consumer keys and secrets of registered applications.
- WSO2 adjusts the score down to 9.8 for single-tenant deployments, on the grounds that the impact stays inside a single security authority boundary.
Why it matters
- Who's exposed exposure Rotation of consumer keys and secrets is the second half of the remediation. The product is an aggregation point for internal services and credentials, so anything harvested through the bypass keeps working through a trusted gateway after the verifier is fixed.
- What it limits constraint Segmentation alone leaves the authentication process reachable: according to the dev.to writeup, putting the management console on a private network does not close the path where other APIs are configured to accept the vulnerable tokens.
- Who has to decide decision Whether a team can answer "were we hit" depends on whether its logging ever captured JWT header fields, so shops that log URLs only end up with a patch and no finding.
- What doesn't add up contradiction Anyone pricing an emergency change window is pricing a proven technique with no published victim. watchTowr verified the bypass in its own replay while the attempt it observed in the wild failed, and public reporting shows no confirmed subsequent compromise.
Next story · Security · Sep 25
CISA lists WSO2's forged-token bypass as exploited on thin public evidenceConfirmed4 publishers
The advisory states the condition and not the code path. Authentication is bypassed when the JWT is signed using an unsupported algorithm [1]. A verifier that handles that case correctly treats an unrecognised alg as a terminal failure and ends the request. On the affected versions the request continues into an authenticated context [1]. The published vector supplies the rest of the precondition: AV:N, AC:L, PR:N, UI:N [2]. Nothing has to be phished and nobody has to click, which is why the dev.to writeup expects business users to notice no anomaly at all [6]. The attacker needs a route to the vulnerable JWT authentication process, from the internet or from any reachable network [16].
Two vectors are published for the same CVE, and one metric moves between them. The 10 uses S:C. The 9.8 for single-tenant deployments uses S:U, with AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H identical in both strings [22]. WSO2 says the adjustment reflects that the impact is contained within a single security authority boundary [4]. The gap between the two scores is 0.2 points [23].
The advisory is at version 1.0.0 and credits the Hacktron Team with reporting the issue [8][10]. The first exploitation attempts watchTowr observed came 133 days after it was published [21].
A forged token aimed at a product that does not have the flaw is what untargeted scanning looks like. A miss in your own logs does not establish that a correctly aimed request would also miss [12].
The solution section gives subscription holders an update level to reach, and community users the public fixes, with migration to an unaffected version as the fallback [5]. Credential rotation is absent from it. Updating repairs the verifier, but the consumer keys and secrets of registered applications that the replay recovered keep working after the update [14].
Working out whether anyone got in needs the token header. The dev.to analysis notes that JWT header contents are not visible in standard URL logs, so the signing algorithm, the issuer and the signature verification result have to be cross-referenced against existing authentication and API audit logs [17]. It also points at API Manager audit records for access and changes to registered applications, consumer keys and secrets, administrators, and backend definitions [20]. Those records only answer the question if retention reaches back past mid-September [11].
What to watch
- A confirmed in-wild bypass against a correctly versioned deployment would move this from a proven technique to an active breach; watchTowr's honeypot network is where that would surface first.
- A revision past advisory version 1.0.0 that adds detection guidance or credential-rotation instructions to the solution section.
- Whether the observed traffic starts fingerprinting product and version before sending the token, instead of spraying it at the wrong products.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
WSO2 Security Advisory WSO2-2026-5328/CVE-2026-5430 states: JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access. The overview describes it as account takeover via authentication bypass.
- [2]
The advisory rates the issue Critical with a CVSS score of 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- [3]
The advisory says successful exploitation may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.
- [4]
The advisory adjusts the score to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, saying the adjustment reflects that the impact is contained within a single security authority boundary.
- [5]
The advisory's solution section tells community users to apply the public fixes provided, or migrate to the latest unaffected version if applying the fix is not feasible, and tells support subscription holders to update the product to the specified update level or higher.
- [6]
Because user interaction is not required, business users may not notice any anomalies; email is not required for the attack.
- [7]
The basis of severity given is an unauthenticated vulnerability with a CVSS score of up to 10.0; the API management infrastructure serves as an aggregation point for internal services and credentials, and successful exploitation can enable administrator account takeover and provide a foothold for lateral movement.
- [8]
The advisory was published 2026-05-03 at version 1.0.0.
- [9]
Affected products: WSO2 API Control Plane 4.6.0 and 4.5.0; WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0 and 4.1.0; WSO2 Traffic Manager 4.6.0 and 4.5.0; WSO2 Universal Gateway 4.6.0 and 4.5.0.
- [10]
The advisory credits the Hacktron Team for responsibly reporting the identified issue and working with WSO2 as it was addressed.
- [11]
watchTowr observed initial exploitation attempts on September 13, 2026.
- [12]
watchTowr observed an attacker sending a forged JWT to the wrong product in its honeypot network; authentication bypass was not reported as successful in that observed attempt.
- [13]
watchTowr replayed the payload against the correct target product and verified that authentication can be bypassed using a JWT with an unsupported signing algorithm.
- [14]
Researchers said the access gained reached API backend destinations, credentials, and the consumer keys and secrets of registered applications.
- [15]
The publicly observed activity does not confirm actual damage from a subsequent compromise, and public articles do not show examples of successful subsequent compromise.
- [16]
The attacker must be able to reach the vulnerable JWT authentication process, connecting to WSO2 API and management endpoints from the internet or a reachable network.
- [17]
Because JWT header contents are not visible in standard URL logs, the writeup advises cross-referencing them with existing authentication and API audit logs, including the signing algorithm (alg), issuer, subject, audience, signature verification results and post-authentication operations.
- [18]
The writeup notes that making only the management console private may not be sufficient if other APIs are configured to accept vulnerable JWTs.
- [19]
The material is based on a SecurityWeek article, 'Enterprises Warned of Attacks Exploiting WSO2 Vulnerability', published September 16, 2026.
- [20]
The writeup advises checking API Manager audit records for access and changes to registered applications, consumer keys and secrets, administrators and backend definitions, and for traffic from the gateway to internal APIs, management endpoints and data stores that are not normally connected.
- [21]
133 days separate the advisory's publication date and the first exploitation attempts watchTowr observed.
- [22]
The only CVSS metric that differs between the 10 vector and the 9.8 single-tenant vector is Scope: S:C against S:U. AV:N, AC:L, PR:N, UI:N, C:H, I:H and A:H are identical in both.
- [23]
The single-tenant adjustment lowers the score by 0.2 points.
- [24]
API Manager is listed at six versions (4.1.0 through 4.6.0), while the other three affected products are listed only at 4.5.0 and 4.6.0.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toWSO2 CVE-2026-5430: Authentication Bypass in API Management Infrastructure via JWT with Unsupported Algorithm
1 article · September 17, 2026
- Security Advisory WSO2-2026-5328/CVE-2026-5430
security.docs.wso2.com
1 article · September 17, 2026
Topics and entities
Topics
- Vulnerability Exploitation
- JWT Authentication
- API gateway security
Entities
- WatchTowr
- SecurityWeek
- Hacktron
- WSO2 API Control Plane
- WSO2 API Manager
- WSO2 Universal Gateway
- CVSS
- WSO2
- JSON Web Token
- WSO2 Traffic Manager