WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

CISA added a WSO2 authentication-bypass bug to the KEV catalog on September 24 with a September 27 due date. The vendor advisory is clearer than the catalog blurb: craft a JWT with an unsupported signing algorithm, and the gateway may accept it — including for administrative accounts.

If your API gateway trusts a weird JWT algorithm, it does not matter how strong the password was.

What happened

CVE-2026-5430 (WSO2 advisory WSO2-2026-5328) is an account-takeover via authentication bypass in multiple WSO2 API products. JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access. WSO2 rates it Critical (CVSS 10.0 in multi-tenant impact framing; 9.8 for single-tenant).

Affected products include WSO2 API Manager 4.1.0–4.6.0, API Control Plane 4.5.0/4.6.0, Traffic Manager 4.5.0/4.6.0, and Universal Gateway 4.5.0/4.6.0. Support subscribers apply the listed update levels (for example API Manager 4.6.0 update level 21); community users can pull the public fixes from the carbon-apimgt / product-apim pull requests referenced in the advisory. CISA added the CVE to KEV on September 24, 2026 (catalog text currently mislabels it as path traversal — follow the vendor description: JWT algorithm bypass).

Why it matters

API Manager and the Universal Gateway sit on the trust boundary for every backend your mobile apps and partners call. An auth bypass there is not “one API key leaked” — it is potentially admin session equivalent, configuration changes, and a path into the systems behind the gateway. The federal due date was Sunday; Monday morning is when most change boards will actually look at it.

What to do first

• Identify every WSO2 API Manager, Universal Gateway, Traffic Manager, and API Control Plane instance (prod and non-prod that still hold real tokens).
• Apply the WSO2 Updates levels from advisory WSO2-2026-5328, or the public GitHub fixes, or migrate to an unaffected latest release.
• Until patched: restrict management consoles to admin networks; consider temporarily disabling JWT auth grant types you do not need.
• Review auth and audit logs for successful admin / publisher / subscriber logins with unusual JWT headers (unexpected alg values) since at least mid-May 2026 disclosure.
• Rotate client secrets, admin passwords, and refresh tokens issued through affected gateways if compromise is plausible.

Details

• CVE / advisory: CVE-2026-5430 / WSO2-2026-5328 — JWT authentication bypass via unsupported signing algorithm
• Impact: unauthorized access, potential administrative account takeover
• Products: API Manager 4.1.0–4.6.0; API Control Plane 4.5.0–4.6.0; Traffic Manager 4.5.0–4.6.0; Universal Gateway 4.5.0–4.6.0
• Fix: WSO2 Updates levels in the advisory table (e.g. APIM 4.6.0 UL 21, 4.5.0 UL 57, …) or public PRs #13752 / #14167
• Vendor published: 2026-05-03; KEV added: 2026-09-24 (due 2026-09-27)
• Credits: Hacktron Team

Hunt / verify

• Confirm update level / build includes WSO2-2026-5328 on every node.
• Search gateway access logs for JWTs with unusual alg values (none, HS256 where RS256 expected, etc.) accepted as valid.
• Audit recent changes to API products, applications, and admin users.
• Verify management ports are not Internet-exposed.

Slack paste: WSO2 APIM/Gateway to WSO2-2026-5328 update levels today (KEV due was Sep 27); review JWT admin logins; rotate gateway secrets if the box was late.

Sources

• WSO2 — Security Advisory WSO2-2026-5328 / CVE-2026-5430
• CISA — Adds two KEVs (Sep 24, 2026)
• The Hacker News — WSO2 and Adobe Commerce flaws exploited

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.