17 SEP 2026 — Forged administrator tokens started arriving at watchTowr's honeypots on 13 September, aimed at WSO2 API gateways that the vendor had already fixed in April.
The flaw is CVE-2026-5430, and WSO2 scored it 10.0. Nothing about the exploitation is novel. The five-month gap between fix and attack is the story.
What the flaw actually is
The gateway checks a JSON Web Token's signature and reaches the wrong conclusion. WSO2 describes it in one sentence: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access."
The failure is specific. A token arrives signed with an algorithm the product does not support, and the gateway accepts it instead of refusing it. No key, credential or prior foothold is required; the attacker needs to know which algorithm the parser mishandles.
Readers who have followed our guide to JWT verification will recognise the shape. Decoding a token only exposes its claims. Verifying checks that a trusted signature backs them. Conflate the two and you authenticate whoever asks.
Two scores for one flaw
The advisory carries two scores, and both are right for their deployment model. WSO2 publishes 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and states that for single-tenant deployments the score adjusts to 9.8.
The difference is the scope metric. In a multi-tenant gateway, compromising the authentication layer reaches past the vulnerable component into tenants it was supposed to keep apart, so the scoring system marks that as a changed scope. In a single-tenant deployment there is nothing else to reach; the same bug scores 9.8.
That detail matters for anyone reconciling advisories. The score you see depends on the source, not the installed version.
What a forged token opens
Yordan Ganchev, principal threat intelligence specialist at watchTowr, described the reach of a single accepted token: "The forged token yields access to every API backend endpoint and its credentials, consumer keys and secrets for every registered application."
An API gateway holds the credentials for everything behind it, which is why you put one in front of an estate. Compromising it is closer to reading the key cabinet than to picking one lock.
The affected list runs wider than the flagship product. WSO2 names API Manager 4.1.0 through 4.6.0, and API Control Plane, Traffic Manager and Universal Gateway at 4.5.0 and 4.6.0. The Hacktron Team is credited with reporting it.
Five months of available fix
WSO2 published its advisory, WSO2-2026-5328, on 3 May; SecurityWeek dates the fix itself to April. Either way the remedy has been available for months, offered two ways: pull requests in the open-source repositories, and update levels for subscribers.
The update levels show how long these deployments run. API Manager 4.6.0 needs Update 21. API Manager 4.1.0, still supported and still affected, needs Update 257. A product on its two-hundred-and-fifty-seventh patch level is a product that organisations install once and leave running; that population is the least likely to have applied number 257 in April.
We have seen this shape before. The GitLab flaw scored 10.0 drew probes the next day, and the Artifactory admin-token chain hit the same kind of credential store. The difference here is the delay. Attackers did not race the patch; they waited five months, until it was old enough to be widely ignored.
What to watch
Start with rotation, not patching. A gateway that was reachable between April and September may have handed over consumer keys and secrets already, and installing the update closes the door on a room that has been emptied. Anyone patching now should treat every credential the gateway held as disclosed.
Then the exposure count. Neither watchTowr nor the reporting on it publishes an estimate of internet-facing instances, so the size of the affected population is unknown rather than merely unstated.
Then the catalogue. CVE-2026-5430 has not appeared in CISA's Known Exploited Vulnerabilities list at the time of writing. Honeypot traffic shows attempts, not successful compromise at a named organisation, and the KEV entry is where federal deadlines usually make the difference visible.
View author profile → · Editorial policy
