A critical vulnerability in WSO2 API Manager is being actively exploited, according to security research firm watchTowr. The flaw, tracked as CVE-2026-5430, carries a CVSS score of 9.8 and stems from improper verification of a cryptographic signature. The issue is a JWT bypass that can be used to forge admin tokens.
watchTowr observed active exploitation attempts in the wild, meaning attackers are already trying to take advantage of the flaw. Because the vulnerability allows forged admin tokens, a successful attack could grant unauthorized administrative access to the API management platform. The report is based on a single source, so independent verification has not yet been published.
Given the severity and active exploitation, organizations using WSO2 API Manager should treat this as urgent. Administrators are advised to review their systems for signs of compromise and apply any available patches or mitigations from WSO2.