Critical WSO2 API Manager Vulnerability Exploited in the Wild Unidentified threat actors have begun exploiting CVE-2026-5430, a critical authentication bypass vulnerability in WSO2 API Manager, nearly five months after a patch was released. The flaw, tracked with a CVSS score of 10 (downgraded to 9.8 in single-tenant deployments), allows attackers to forge JWT tokens with administrator privileges, granting full access to backend APIs, credentials, and sensitive data in transit. Security firm watchTowr Intel detected exploitation attempts on September 13, with attackers leveraging the vulnerability to intercept API requests and move laterally within compromised systems. The flaw affects WSO2 API Manager versions 4.1.0 through 4.6.0, as well as the API Control Plane, Traffic Manager, and Universal Gateway. Despite WSO2’s initial patch in April and a public advisory in May, the severity of the issue was initially downplayed in the patch notes, which labeled it as an "improvement in exception handling." The vulnerability’s high impact stems from its ability to expose consumer keys, secrets, and internal service interactions, effectively turning the platform into a "Lateral Movement-as-a-Service" tool for attackers. While WSO2 may not be widely recognized, its enterprise customer base spanning banking, government, telecom, and logistics across 90+ countries makes it a high-value target. Researchers noted that the attackers initially targeted the wrong product but successfully exploited the real one when tested, raising concerns about potential undetected breaches in live environments.

A critical security vulnerability (CVE-2024-6914) in WSO2 products allows attackers to reset passwords for any user account, potentially leading to complete system compromise. The flaw stems from an incorrect authorization issue in the account recovery SOAP admin service, enabling unauthorized access to user accounts, including those with administrative privileges. This vulnerability affects multiple WSO2 products, posing significant security risks to the entire infrastructure.