Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

Security researchers at watchTowr have identified active exploitation attempts targeting a critical vulnerability in WSO2 API Manager. The flaw, designated CVE-2026-5430, carries a CVSS score of 9.8 and is described as an improper verification of a cryptographic signature. This weakness enables attackers to forge admin tokens, effectively bypassing JWT authentication and gaining unauthorized access to API management functions.

The vulnerability was discovered and reported by Hacktron Team. According to watchTowr's findings, the exploitation attempts have been observed in the wild, indicating that threat actors are actively leveraging this flaw. The exact method of exploitation involves crafting forged admin tokens that pass JWT verification due to the cryptographic signature validation flaw.

WSO2 API Manager is widely used by enterprises to manage APIs, and a successful exploit could lead to account takeover, unauthorized access to sensitive API configurations, and potential data exfiltration or service disruption. The severity of the issue is underscored by the high CVSS score and the active exploitation reports.

Organizations running WSO2 API Manager should treat this as a high-priority security incident. WSO2 has likely released security updates to address the vulnerability; administrators are strongly advised to apply the latest patches immediately. Additionally, reviewing JWT configuration guidelines provided by WSO2 can help mitigate the risk.

While the full scope of the active exploitation is not yet fully disclosed, the initial reports from watchTowr and The Hacker News highlight the urgency. Security teams should monitor official WSO2 advisories for detailed patch information and any additional mitigation steps.