Attackers are actively exploiting a critical vulnerability in WSO2 products that can bypass authentication and provide access to sensitive enterprise systems. The flaw, tracked as CVE-2026-5430, carries the maximum CVSS severity score of 10 and was patched by WSO2 earlier this year.
WSO2 provides open-source middleware used to manage APIs, services and identities across cloud and enterprise environments. Its technology is deployed by organizations in sectors including banking, government, telecommunications and logistics, making vulnerable installations potentially valuable targets.
The vulnerability affects WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway. It allows attackers to bypass JWT authentication by creating a token signed with an unsupported algorithm, potentially resulting in unauthorized access and complete account takeover.
Exposure management company WatchTowr detected the first exploitation attempt through its honeypot infrastructure on September 13. Researchers observed an attacker using a forged JWT token, confirming that the vulnerability has moved beyond theoretical exploitation into real-world attacks.
A successful forged token can provide access to API backend endpoints as well as credentials, consumer keys and secrets associated with registered applications. This creates a particularly serious risk because WSO2 infrastructure frequently acts as an intermediary between external API requests and sensitive internal services.
Compromising such a platform could consequently provide attackers with opportunities for lateral movement. Instead of compromising individual backend applications separately, an attacker controlling the API layer may be able to interact with multiple internal services or intercept sensitive information moving through the platform.
WatchTowr said the attacker observed by its honeypot initially targeted the wrong WSO2 product. Researchers subsequently replayed the attack against the correct vulnerable product and confirmed that the payload worked.
Interestingly, detailed public exploitation information was not required to reproduce the vulnerability. Although the CVE record appeared only in early August and technical details remained limited, WatchTowr researchers were able to understand the flaw by analyzing changes introduced in WSO2’s earlier security patch.
This illustrates a familiar problem in vulnerability management: security patches themselves can provide clues about the underlying weakness. Attackers can compare vulnerable and patched versions to identify the relevant code changes and potentially reconstruct an exploit even when vendors avoid publishing detailed technical information.
Organizations running affected WSO2 products should therefore verify that the security updates released for CVE-2026-5430 have been installed. Because active exploitation has already been observed, systems that remained exposed should also be investigated for suspicious authentication activity and unexpected access to API resources.
Administrators should pay particular attention to unusual JWT tokens, unexpected administrative access and attempts to retrieve backend credentials or application secrets. Credentials accessible through a potentially compromised WSO2 environment may also need to be rotated if there is evidence of successful exploitation.
CVE-2026-5430 demonstrates why vulnerabilities affecting API management infrastructure can have consequences far beyond a single application. When attackers compromise the platform responsible for connecting external requests with internal services, they may gain access to credentials, sensitive data and pathways deeper into the enterprise network.