security_identifier

CVE-2026-5430

Catalogue identifier for an improper cryptographic signature verification flaw in WSO2 API management products that permits JWT authentication bypass.

Current clusters

security2 publishers

Forged admin JWTs are landing on WSO2 API Manager four months after the fix shipped

CVE-2026-5430 lets a token signed with an algorithm WSO2 does not support pass authentication as an administrator. watchTowr says tokens with administrator privileges baked in reached its honeypots on September 13.

Publishers:securityweek.comthehackernews.com

Reality

Evidence64
Adoption25
Hype gap+12
Incentives60
Confidence60