Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical vulnerability tracked as CVE-2026-5430 (CVSS 9.8) has been discovered in WSO2 API Manager. The flaw involves improper verification of cryptographic signatures in JWT authentication, allowing attackers to forge admin tokens and perform account takeover. The vulnerability was discovered and reported by the Hacktron Team and has been credited to watchTowr for identifying active exploitation in the wild. Attackers are actively attempting to exploit this flaw to gain unauthorized administrative access. The severity and active exploitation status make this a high-priority patching concern for organizations using WSO2 API Manager.