WSO2 CVE-2026-5430: a forged token walks your gateway

Your API gateway is the one box that sees every request in plaintext, and CVE-2026-5430 lets an attacker walk through it with a token it made up. On September 24, CISA added the flaw to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 27 — three days. WSO2 published the advisory on May 3, 2026. If you run WSO2 API Manager and nobody owns its update level, that is the whole story again.

What actually happened

WSO2's own advisory is blunt: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access." An unauthenticated attacker presents a token signed with an algorithm the server should reject, the server accepts it anyway, and the request arrives with whatever privileges the token claims. CVSS 10.0 in the multi-tenant vector, 9.8 adjusted for single-tenant deployments.

Affected: API Control Plane 4.5.0–4.6.0, API Manager 4.1.0 through 4.6.0, Traffic Manager 4.5.0–4.6.0, Universal Gateway 4.5.0–4.6.0. The fix is a WUM update level per product and version — API Manager 4.1.0 needs level 257, 4.2.0 needs 197, 4.6.0 needs 21. Read the table; the number is different for every line.

SecurityWeek reports that watchTowr saw exploitation attempts against its honeypots starting September 13, with attackers forging tokens to reach backend endpoints and pull credentials, consumer keys and application secrets.

One discrepancy worth flagging: the CISA KEV entry titles this a "Path Traversal Vulnerability" leading to unrestricted file upload and RCE. The vendor advisory describes an authentication bypass. We are reporting the vendor's description because it is the vendor's product — but either way, the remediation is the same update level, so patch first and argue about taxonomy later.

Why your API gateway matters for your business

A gateway compromise is not one breach, it is every backend at once. That is the point of a gateway. Everything behind it trusted the identity the gateway asserted. When the assertion is forgeable, every service that skipped its own authorization check because "the gateway handles that" is now open.

Signature verification is where auth libraries go to die. "Accepts a token signed with an unsupported algorithm" is a family of bug, not a one-off. If you wrote any JWT validation yourself, go look right now for whether you pin the expected algorithm explicitly or read it out of the token header. Reading it from the header is the bug.

Middleware has no patch cadence. Your laptops nag you. Your gateway does not. It was stood up during an integration project, it has run ever since, and its update level is whatever it was on install day. A May advisory reaching a September KEV listing is what that looks like from the outside.

Rotate, do not just patch. The reported theft is credentials, consumer keys and application secrets. Patching stops the next forged token; it does nothing about a key copied in September. Cycle the consumer keys and secrets for every registered application, then check backend logs for requests that arrived authenticated but match no session you can account for.

If you are on a vendor-managed WSO2 deployment, the email you send today is one line: which update level are we on, and when did it get applied.

Sources: WSO2 Security Advisory, CISA KEV Catalog, SecurityWeek.