What the vulnerability is
A CVSS 9.8 authentication bypass in WSO2 API Manager (tracked as CVE-2026-5430) arises because the server validates tokens signed with algorithms other than those it is configured to use. JWT authentication works by having a server generate a signed token and having clients present that token on subsequent requests. The server validates the token by checking its signature using the algorithm declared in the token header.
An attacker who knows about this flaw can craft a JWT with arbitrary claims, such as administrator role membership, sign it with an unsupported algorithm, and present it to the API Manager. The server checks the signature, but the check passes because the unsupported algorithm path does not correctly enforce the expected key material. The attacker receives a valid session with full administrative privileges.
This class of vulnerability has a name in cryptographic engineering: algorithm confusion or algorithm substitution. It has appeared in JWT libraries repeatedly since at least 2015. The fix is always the same: explicitly allowlist the accepted signing algorithm. Never infer the algorithm from the token header.
Who is affected
The vulnerability affects WSO2 API Manager versions 4.1.0 through 4.6.0, WSO2 API Control Plane 4.5.0 and 4.6.0, WSO2 Traffic Manager 4.5.0 and 4.6.0, and WSO2 Universal Gateway 4.5.0 and 4.6.0. The Hacktron Team is credited with discovery. WSO2 published security advisory WSO2-2026-5328.
How it is being exploited
watchTowr captured exploitation in the wild via their honeypot network on September 13, 2026. The honeypot received JWT tokens with administrator privilege claims, indicating attackers are systematically probing internet-facing WSO2 deployments. The exploitation is not sophisticated: it requires only knowledge of the vulnerability and the ability to reach the management plane over HTTPS.
Organizations that expose the WSO2 API Manager administrative interface to the internet are at highest immediate risk. Organizations whose management plane is accessible only from internal networks have a lower but nonzero risk, since the same technique works from any internal network position.
What to do today
First, upgrade to WSO2 API Manager 4.6.0 or apply the patch described in WSO2 Security Advisory WSO2-2026-5328. Where upgrade is not immediately possible, restrict network access to the API management plane to trusted IP ranges only. This does not fix the vulnerability but eliminates internet-based exploitation.
Second, review logs for evidence of compromise. Look for unexpected administrator sessions, configuration changes made outside normal change-management windows, and API policy modifications. watchTowr honeypot data indicates exploitation began September 13; review logs from at least that date.
Third, treat any compromise of the API Manager as a potential full API gateway compromise. An attacker with administrative access can modify API policies, exfiltrate API keys and credentials stored in the platform, and redirect API traffic.
The broader lesson
Algorithm confusion in JWT validation is one of the most durable categories of authentication bypass in web security. It persists because JWT libraries often prioritize flexibility over security by default. Any service that uses JWT authentication and does not explicitly pin the accepted signing algorithm to a fixed allowlist is in the same risk category. Add this to your next secure-code review: confirm the JWT validation layer explicitly declares accepted algorithms, rejects anything not on that list, and does not trust the algorithm field in the token header.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization uses WSO2 or is assessing API gateway security posture.