SecurityOnlineDo Son
WSO2 patches critical JWT bypass flaw, putting bank APIs at risk
Part of the CVE-2026-5430 story · since 30 Jun
- Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV. This article, 1st of 6.
- Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV.
- Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
In June 2026, WSO2 patched seven vulnerabilities in its API platform, including the critical [CVE-2026-5430](https://securityonline.info/cve-watchtower/?cve_detail=CVE-2026-5430), which scores 10/10 for allowing JWT authentication bypass. This vulnerability enables full account takeover without user interaction, creating significant risks for enterprise APIs used by banks and government agencies.
Other vulnerabilities include privilege escalation, file upload issues, SQL injection, denial of service, and SSRF, varying in severity. Affected versions range from WSO2 API Manager 4.6.0 to earlier releases. WSO2 has released patches, and users are urged to apply updates promptly to safeguard their systems.
How the story developed
6 articles from 4 outlets since 30 Jun. Quiet since 25 Sep. This was the first report.
- Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV. This article, 1st of 6.
- Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV.
- Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Tue 30 JunDay 01
- WSO2 patches critical JWT bypass flaw, putting bank APIs at risk04:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE · This article, 1st of 6
Quiet for 5 weeks
Fri 7 AugDay 381- WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged14:02 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 6 weeks
Wed 16 SepDay 781- Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets09:00 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 8 days
Thu 24 SepDay 861- CISA Warns of Active Exploits Targeting Critical WSO2 Flaw20:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Fri 25 SepDay 872
- CISA Flags Critical WSO2 and Magento Flaws Used in Attacks09:30 · Security Affairs · Known exploited CVE