Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets

A critical WSO2 vulnerability patched earlier this year is being exploited in the wild, according to exposure management firm WatchTowr. Tracked as CVE-2026-5430 and rated 10.0 on the CVSS scale, the flaw affects WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway.

WSO2 said in a May advisory that attackers can bypass authentication by signing a JSON Web Token (JWT) with an unsupported algorithm, potentially gaining unauthorised access, compromising administrative accounts and taking over accounts. WSO2 has nearly 1,000 enterprise customers worldwide, with additional deployments through open-source installations, OEMs and partners.

WatchTowr’s honeypot network recorded its first exploitation attempt on 13 September, said Yordan Ganchev, the firm’s principal threat intelligence specialist. The attacker used a forged JWT. Ganchev said the token provided access to API backend endpoints, including credentials, consumer keys and secrets for registered applications. Because WSO2 services can intercept API requests to internal systems, successful exploitation could allow attackers to steal data in transit and interact with internal services.

WatchTowr observed one attacker targeting the wrong product, but said the payload worked when replayed against the genuine product.

The CVE record was published in early August, and technical details were reportedly not yet public. WatchTowr said it reproduced the issue from WSO2’s patch. Organisations using affected WSO2 products should apply the vendor’s April fix and assess systems for possible unauthorised access, although the report does not identify confirmed victims.