Hackers Are Forging Admin Tokens to Take Over WSO2 API Manager

Key points

• WSO2 API Manager has a critical flaw, CVE-2026-5430, rated 9.8 out of 10 on the industry severity scale.
• The bug lets attackers forge login tokens and take over administrator accounts on affected servers.
• Security firm watchTowr says criminals are already trying to exploit it in the wild.
• The flaw was found and reported by the Hacktron Team.
• WSO2 API Manager is used by companies to run and secure the software connections (APIs) that link their apps and services.

A serious flaw in WSO2 API Manager, a widely used tool for managing software connections between business apps, is being actively attacked online.

The bug is tracked as CVE-2026-5430. It carries a severity score of 9.8 out of 10, putting it in the top tier of software flaws. Security company watchTowr says it's seeing exploitation attempts in the wild: real attackers, not just researchers, are trying it against live systems. The Hacker News first reported the active exploitation.

When you sign in to a modern web service, the server hands your browser a small digital pass called a JWT (short for JSON Web Token). The server signs that pass with a secret key so it can trust it later. WSO2 API Manager wasn't checking those signatures properly. An attacker who understands the flaw can write their own pass, hand it to the server, and be treated as anyone, including an administrator. That means full account takeover. Once inside as an admin, an attacker can read and change how a company's APIs work or pull data flowing through them.

This isn't a new category of problem. We covered a near-identical no-password admin takeover in JFrog Artifactory on 2 September, and that pattern keeps repeating across enterprise tooling that sits in front of critical infrastructure.

What is WSO2 API Manager and who uses it?

It's enterprise software that companies install to publish and control APIs, the digital pipes that let apps talk to each other. Banks, telecoms and government departments use products like it. If your bank's mobile app fetches your balance, an API is doing the fetching. A tool like WSO2 sits in front of those APIs and decides who is allowed to call them.

That's why an admin-level bug here is serious. The tool guarding the pipes is the tool being broken.

How bad is CVE-2026-5430?

Bad enough that defenders should treat it as an emergency. The 9.8 score reflects three conditions: exploitable over the network, no valid login required, and it hands the attacker top-level access. Active exploitation raises the urgency further. There's no working around this with clever configuration. The fix has to be the vendor patch.

What should companies running WSO2 do right now?

Apply the vendor's security update as soon as it's available and check WSO2's official advisory for the exact fixed versions for your deployment. Until then, restrict who can reach the management interface from the open internet. Review admin account activity for logins you don't recognise, and rotate any credentials an intruder with admin access could have copied.

Should ordinary customers worry?

There's nothing an individual customer needs to install or change. This is a server-side flaw in a product companies run behind the scenes. If a service you use has been affected and data was taken, the company is legally required to tell you. Be wary of any email that claims to be from a service and asks you to log in through a link.

The pattern worth watching: WSO2, JFrog, Cisco, Fortinet. Each of these is a platform that manages access for everything downstream. Attackers have clearly noticed that breaking the gatekeeper is more efficient than breaking what it protects.