TLDR Tech / InfoSec
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.
Read the full story