In September 2026, a critical flaw in WSO2 API Manager (CVE-2026-5430, CVSS 9.8) came under active exploitation. It stems from improper verification of a JWT signature, letting attackers forge admin tokens and take over accounts. Organisations running affected versions should patch immediately and check for unauthorised access.
What happened
In mid-September 2026, security researchers reported active exploitation of a critical vulnerability in WSO2 API Manager, tracked as CVE-2026-5430 and rated 9.8. The flaw is a case of improper verification of a cryptographic signature, specifically a JSON Web Token, or JWT, signature. When an application does not properly verify the signature on a token, an attacker can forge one, and the application will trust it.
In this case, that means an attacker can forge administrative tokens and gain unauthorised access, leading to account takeover. Because the flaw is being actively exploited and carries near-maximum severity, organisations running affected versions of WSO2 API Manager should treat it as urgent, patching immediately and checking for signs of unauthorised access.
What a JWT signature flaw actually means
To understand why this is so serious, it helps to know what a JWT does. A JSON Web Token is a common way for applications to prove who a user is after they log in. The token carries claims, such as who the user is and what they are allowed to do, and it is signed so the application can verify it is genuine and has not been tampered with. That signature is the whole basis of trust: if it verifies, the application accepts the token’s claims.
CVE-2026-5430 breaks that trust. When the signature is not properly verified, an attacker can craft their own token, claim to be an administrator, and the application will believe them. There is no need to steal a real token or guess a password. The attacker simply forges a valid-looking token and walks in with the privileges they granted themselves.
Why this leads to account takeover
The consequence of a forged admin token is account takeover at the highest level. An attacker who can forge an administrative token is not just accessing one account, they are potentially gaining administrative control over the API management platform. From there, the damage can extend to the APIs it manages and the data and systems behind them.
API management platforms sit at a sensitive point in an organisation’s architecture, governing access to APIs that often front important data and functionality. Administrative control over that platform is a powerful position for an attacker, which is exactly why a flaw enabling forged admin tokens is rated critical and is being actively exploited.
Who is exposed
Any organisation running an affected version of WSO2 API Manager should treat itself as exposed until patched, particularly where the platform is reachable in ways an attacker could reach. WSO2 is used by organisations to manage and secure their APIs, so a flaw in it affects the systems and data those APIs govern. If you are unsure whether you run an affected version, or whether your instance is exposed, resolving that uncertainty is the first task.
Immediate actions
If you run WSO2 API Manager, treat this as urgent:
- Apply the vendor’s patch for CVE-2026-5430 immediately, following the official advisory
- Check for signs of unauthorised access, since exploitation is already occurring and a forged token may already have been used
- Review administrative activity for anything unexpected on the platform
- Restrict exposure of the management platform where it does not need to be broadly reachable
- Rotate credentials and secrets that may have been exposed through unauthorised access
Because the flaw is being actively exploited, patching alone may not be enough if an attacker has already forged a token and gained access. Checking for and remediating any existing intrusion is part of the response.
Why authentication flaws deserve priority
This incident is a reminder that flaws in authentication, the mechanisms that prove who a user is, are among the most serious an organisation can face. When authentication can be bypassed or forged, every control that assumes a logged-in user is legitimate is undermined. An attacker who can forge an admin token does not need to defeat your other defences, they arrive already trusted.
Building this into your patching priorities, treating authentication flaws on important platforms as urgent regardless of how routine the update seems, is what turns an incident like this into a quick fix rather than a breach. Pairing it with monitoring means that even in the window before patching, signs of forged access can be detected.
If you want help finding your exposed platforms, checking for unauthorised access, or testing your API security, see our application security testing, or our managed detection and response services.
For the authoritative details, confirm against the WSO2 security advisory and the CISA Known Exploited Vulnerabilities catalogue.
Frequently asked questions
What is CVE-2026-5430?
CVE-2026-5430 is a critical flaw in WSO2 API Manager, rated 9.8, caused by improper verification of a JWT signature. It allows attackers to forge administrative tokens and gain unauthorised access, leading to account takeover. It is being actively exploited.
What does a JWT signature flaw allow?
A JSON Web Token is signed so an application can verify it is genuine. When the signature is not properly verified, an attacker can forge a token, claim to be an administrator, and have the application trust it, without stealing a real token or password.
Who is affected?
Organisations running affected versions of WSO2 API Manager, which is used to manage and secure APIs. A flaw in it affects the APIs it governs and the data and systems behind them, so exposed instances should be treated as at risk until patched.
What should I do?
Apply the vendor’s patch immediately, check for signs of unauthorised access since exploitation is already occurring, review administrative activity, restrict exposure of the platform, and rotate any credentials that may have been exposed. Verify no intrusion occurred, not just that you patched.
