WSO2 API Manager faces critical authentication bypass vulnerability

A critical authentication bypass vulnerability, identified as CVE-2026-5430, has been actively exploited in WSO2 API Manager products. The flaw, which carries a CVSS score of 10, allows attackers to bypass JSON Web Token (JWT) authentication using tokens signed with unsupported algorithms. Successful exploitation can lead to unauthorized access, administrator account compromise, and full account takeover.

Security researchers at watchTowr detected malicious attacks targeting this vulnerability starting in mid-September 2026. Due to the severity and active exploitation, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog in late September. The risk is considered high globally, as WSO2 serves over 950 customers across more than 90 countries, including operators of critical infrastructure.