---
schema: 1
kind: vulnerability
title: "CVE-2026-5430 — WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway: a JWT algorithm-confusion bypass reaches full administrative control of the API gateway, exploited since 13 September (CVSS 10.0/9.8)"
headline: "A forged JWT with the wrong signature algorithm walks straight into admin on WSO2's API gateway stack"
summary: >
  WSO2's own advisory (WSO2-2026-5328, 2026-05-03) fixed CVE-2026-5430: a JSON Web Token signed with an
  unsupported algorithm is accepted instead of rejected, letting an unauthenticated attacker forge an
  admin-scoped session across WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway.
  WatchTowr's honeypots caught the first forged-token exploitation attempt on 2026-09-13, four months
  after the fix shipped, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on
  2026-09-24. Any organization running an internet- or partner-facing WSO2 API gateway below the fixed
  update level must patch now and treat the gateway as untrusted until it is rebuilt.
discovered_at: "2026-09-25T04:26:00Z"
updated_at: null
event_date: "2026-09-13"
run_id: 2026-09-25T0404Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, auth-bypass, pre-auth, actively-exploited, cisa-kev, patch-available, identity]
regions: [global, europe]
sectors: [public-sector, technology, finance, telco]
entities: ["product:wso2-products", "product:wso2-api-manager", "product:wso2-api-control-plane", "product:wso2-traffic-manager", "product:wso2-universal-gateway"]
techniques: [T1190, T1606]
affected_products: ["WSO2 API Manager", "WSO2 API Control Plane", "WSO2 Traffic Manager", "WSO2 Universal Gateway"]
cves:
  - id: CVE-2026-5430
    cvss: "10.0 multi-tenant / 9.8 single-tenant"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "API Control Plane 4.6.0/4.5.0; API Manager 4.6.0/4.5.0/4.4.0/4.3.0/4.2.0/4.1.0; Traffic Manager 4.6.0/4.5.0; Universal Gateway 4.6.0/4.5.0 — each and earlier update levels"
    fixed: "API Control Plane 4.6.0.22 / 4.5.0.58; API Manager 4.6.0.21 / 4.5.0.57 / 4.4.0.72 / 4.3.0.108 / 4.2.0.197 / 4.1.0.257; Traffic Manager 4.6.0.21 / 4.5.0.56; Universal Gateway 4.6.0.21 / 4.5.0.57"
sources:
  - url: "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"
    publisher: "WSO2"
    date: "2026-05-03"
    role: primary
  - url: "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/"
    publisher: "SecurityWeek"
    date: "2026-09-16"
    role: corroborating
  - url: "https://www.inceptionsecurity.com/post/hunt-wso2-jwt-auth-bypass"
    publisher: "Inception Security"
    date: "2026-09-21"
    role: corroborating
  - url: "https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-09-24"
    role: corroborating
closed_sources: []
evidence:
  - quote: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access."
    publisher: "WSO2"
    source_url: "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"
  - quote: "The forged token yields access to every API backend endpoint and its credentials, consumer keys and secrets for every registered application"
    publisher: "watchTowr's Yordan Ganchev, via SecurityWeek"
    source_url: "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/"
  - quote: "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation."
    publisher: "CISA"
    source_url: "https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog"
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: true
deep_dive_category: identity-infra
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Patch every internet- or partner-facing WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway node to the fixed update level now; where that is not immediate, pull the management and gateway interfaces off the public internet. Then hunt gateway/Carbon auth logs from 2026-09-13 for admin-scoped sessions with no matching identity-provider login, and rotate consumer keys, application secrets and admin credentials on any node found below the fixed level — the forged token reaches every credential the gateway stores."
updates: []
migrated_from: null
---

WSO2's API management stack sits between client applications and the backend services, keys and secrets it fronts, so a broken authentication boundary at the gateway compromises everything behind it. CVE-2026-5430 is exactly that break: a JSON Web Token verifier that should refuse any token signed with an algorithm it does not support instead accepts it, so a forged token is treated as a legitimate, admin-scoped session ([WSO2, 2026-05-03](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)). The bug reaches WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway across the release lines WSO2's advisory lists (4.1.0 through 4.6.0), and needs no credentials and no user interaction — WSO2 rates it CVSS 10.0 on multi-tenant deployments and 9.8 on single-tenant, where impact stays inside one security-authority boundary. WSO2 published the fix on 2026-05-03; four months later, on 2026-09-13, exposure-management firm watchTowr's honeypot network caught the first forged-token exploitation attempt in the wild, and watchTowr says it "easily reproduced" the vulnerability based on the vendor's own patch ([SecurityWeek, 2026-09-16](https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/)). CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on 2026-09-24, alongside an unrelated Adobe Commerce flaw ([CISA, 2026-09-24](https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog)).

The forged admin token is not a narrow read-only leak: watchTowr's Yordan Ganchev describes it as yielding "access to every API backend endpoint and its credentials, consumer keys and secrets for every registered application," and notes the gateway is "by definition made to intercept API requests on their way to internal systems," turning a compromised node into what he calls a "Lateral Movement-as-a-Service" product for reaching everything the gateway fronts ([SecurityWeek, 2026-09-16](https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/)). Ganchev also cautions that the observed attack targeted the wrong WSO2 product in watchTowr's own honeypot mix, but the same forged payload worked when replayed against the correct one — a coincidence that will not repeat on every real deployment. One notable inconsistency for defenders relying on the KEV catalog alone: CISA's own alert lists this addition as "WSO2 Multiple Products Path Traversal Vulnerability" — a title that matches neither WSO2's advisory nor any researcher account, all of which agree this is a JWT-signature bypass, not path traversal ([CISA, 2026-09-24](https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog); [WSO2, 2026-05-03](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/)). A team that searches its KEV feed only for "path traversal" risks missing that this is the entry meant.

Kill chain: an attacker crafts a JWT whose header names a signing algorithm the gateway's verifier does not support, then presents it at the API Manager, Control Plane, Traffic Manager or Universal Gateway front door (T1190, exploiting the public- or partner-facing gateway interface); the verifier's missing algorithm check accepts the token instead of rejecting it, so the forged credential (T1606, Forge Web Credentials) is treated as an authenticated, administrator-scoped session with no legitimate login behind it. From that session the attacker can read every backend endpoint's credentials, every registered application's consumer keys and secrets, and tap API traffic passing through the gateway to internal systems.

Hunt and detection, telemetry class first: in gateway and Carbon HTTP access and authentication logs, look for admin-scoped sessions or privileged API calls with no corresponding identity-provider login event in the same window — that absence, not any single request, is the signal. Where a WAF or reverse proxy in front of the gateway logs JWT or Authorization header fields, check for `alg` values a correctly configured verifier should never have accepted. In application and consumer-key audit trails, flag reuse, mass export, or unexpected changes to registered applications' keys and secrets immediately following an anomalous authentication event. Start any hunt at 2026-09-13, the date of watchTowr's first observed exploitation attempt, and only look earlier with a specific reason to. **Triage:** a legitimate admin session traces back to a real, logged identity-provider authentication; an admin-scoped session or privileged API call with nothing behind it in the identity provider's own logs is the discriminator — an old version banner or a single stray Bearer token alone is not enough to escalate on.

Hardening: inventory every WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway node — including partner-facing, OEM and forgotten lab instances — and bring each to its fixed update level (community users can apply WSO2's published fixes directly from its `carbon-apimgt` and `product-apim` repositories; support subscribers apply the corresponding WSO2 Updates release). Where immediate patching is not possible, remove management and gateway interfaces from public exposure. Because upgrading fixes the software but says nothing about the window between May and the patch date, any node found running below the fixed level should be treated as untrusted: rotate consumer keys, application secrets and admin credentials, and review every registered application and backend the gateway fronted before trusting it again ([WSO2, 2026-05-03](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/); [Inception Security, 2026-09-21](https://www.inceptionsecurity.com/post/hunt-wso2-jwt-auth-bypass)).

**Defender takeaway:** an API gateway's entire value as a security boundary depends on its verifier correctly rejecting what it does not recognize — this flaw is a reminder to confirm that any JWT, SAML or OAuth verification layer explicitly allowlists accepted signing algorithms rather than merely checking that a signature is present, since an unsupported-algorithm code path is exactly where this class of bypass hides.