{"id":2890,"date":"2026-09-16T08:17:55","date_gmt":"2026-09-16T08:17:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2890"},"modified":"2026-09-16T08:17:55","modified_gmt":"2026-09-16T08:17:55","slug":"active-exploitation-attempts-target-wso2-api-manager-jwt-bypass-with-forged-admin-tokens","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2890","title":{"rendered":"Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Sep 16, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ API Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjenXPNzZ8-fnZOSWlAtRwfZVCV0iy-vnK86gK4vmTGsWSjSS7x9a3k80NLsiEZUym2AjBaYj7pLtxyQju7Hiyl6ttQPyXEPMy7Gwn_bQTTTaUOB-8HbhJfYxl54Z3WE5yqKEoW1vvkCBukKwea-6DlpBiO6i08Zo0GhBoqgRsGGXadsOYy8COPUPQ7rn2w\/s1700-nu-rw-lo-l85-e365\/jwt-api.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to <a href=\"https:\/\/x.com\/inkmoro\/status\/2099925214339727646\" target=\"_blank\">findings<\/a> from watchTowr.<\/p>\n<p>The vulnerability, tracked as <strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-5430\" target=\"_blank\">CVE-2026-5430<\/a><\/strong> (CVSS score: 9.8\/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.<\/p>\n<p>\u00abJWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\u00bb according to an advisory <a href=\"https:\/\/security.docs.wso2.com\/en\/latest\/security-announcements\/security-advisories\/2026\/WSO2-2026-5328\/\" target=\"_blank\">released<\/a> by WSO2 in May 2026. \u00abSuccessful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\u00bb<\/p>\n<p>The shortcoming affects the following products &#8211;<\/p>\n<ul>\n<li>WSO2 API Control Plane: 4.6.0, 4.5.0<\/li>\n<li>WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0<\/li>\n<li>WSO2 Traffic Manager: 4.6.0, 4.5.0<\/li>\n<li>WSO2 Universal Gateway: 4.6.0, 4.5.0<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/trust-world-update-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhYq3TvePXpW0JIC7fXyv7A1W8KQqmb-AZqza2EuPyT0k8Nm5CwHYHISFLKXSKIAyR8JRtqEFQ4zx5jADiAkZKQ08nRWG1jCRV5YAbhKua7WaDdH1L6wsI-xOkoV4brlMfK44UwU-4Q1xqWg0uNN7sZkMCzci4RXYgWMNPHTtuKua7OR4oCbmxE10u0yKnR\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Fixes are available in the following pull requests for community users &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>They have also been released for WSO2 Support Subscription Holders with the below update levels &#8211;<\/p>\n<ul>\n<li>WSO2 API Control Plane 4.6.0 &#8211; Update level 22<\/li>\n<li>WSO2 API Control Plane 4.5.0 &#8211; Update level 58<\/li>\n<li>WSO2 API Manager 4.6.0 &#8211; Update level 21<\/li>\n<li>WSO2 API Manager 4.5.0 &#8211; Update level 57<\/li>\n<li>WSO2 API Manager 4.4.0 &#8211; Update level 72<\/li>\n<li>WSO2 API Manager 4.3.0 &#8211; Update level 108<\/li>\n<li>WSO2 API Manager 4.2.0 &#8211; Update level 197<\/li>\n<li>WSO2 API Manager 4.1.0 &#8211; Update level 257<\/li>\n<li>WSO2 Traffic Manager 4.6.0 &#8211; Update level 21<\/li>\n<li>WSO2 Traffic Manager 4.5.0 &#8211; Update level 56<\/li>\n<li>WSO2 Universal Gateway 4.6.0 &#8211; Update level 21<\/li>\n<li>WSO2 Universal Gateway 4.5.0 &#8211; Update level 57 <\/li>\n<\/ul>\n<p>According to watchTowr, the vulnerability is now witnessing active in-the-wild exploitation attempts, with its honeypot network capturing JWT tokens arriving on September 13, 2026, with baked-in administrator privileges. <\/p>\n<p>\u00abThe flaw exists in the service due to how JWT authentication accepts tokens signed with algorithms it does not support, then approves them anyway,\u00bb Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/event-security-need\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhJkE4t8oCql1wmWVt687J1yD7WnYRqvIpcsUwFSVUO-0HpxZWMCxLmeYwBlz38-C0KD-R6f9Pg0swgPTQuBsNXck_Kl3iKWNSQtyMcDNUSZGhiBd_XFu6U1SQi5LhuW-FHg00iT3CbRCUgMoCwhZevwxp8-9gwM2wZVVtGVO8Z2NbZ5EjVmI2dH4adnSAk\/s728-nu-rw-lo-l85-e365\/Shai-Hulud-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abSo, it&#8217;s easy to see why this is a critical bug (CVSS 10.0). It affects API Manager 4.1.0 through 4.6.0, API Control Plane, Traffic Manager and Universal Gateway.\u00bb<\/p>\n<p>In the observed exploitation attempts, the forged JWT token is suspected to be used to gain access to every API backend endpoint and its credentials, consumer keys, and secrets for every registered application, Ganchev added.<\/p>\n<p>\u00abThe service is also by definition made to intercept API requests on their way to internal systems, which provides a great opportunity to tap and steal sensitive data in transit and interact with internal services through this &#8216;lateral movement-as-a-service&#8217; product.\u00bb<\/p>\n<p>In light of active exploitation, users are advised to apply the fixes as soon as possible for optimal protection.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Sep 16, 2026Vulnerability \/ API Security A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability,&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2891,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,129,14,1202,394,65,3425,3078,473,492,146,3424],"class_list":["post-2890","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-admin","tag-api","tag-attempts","tag-bypass","tag-exploitation","tag-forged","tag-jwt","tag-manager","tag-target","tag-tokens","tag-wso2"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2890"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2890\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2891"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}