SecurityOnlineDo Son
WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged
Part of the CVE-2026-5430 story · since 30 Jun
- Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV.
- Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV. This article, 2nd of 6.
- Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
WSO2 disclosed four critical security vulnerabilities affecting its API Manager, Identity Server, and Universal Gateway products. The most severe flaw, CVE-2026-5430, has a CVSS score of 10, allowing for an account takeover via a JWT authentication bypass. Other vulnerabilities include CVE-2026-1728 (9.8), leading to privilege escalation, CVE-2025-15039 (9.4) concerning adaptive authentication flaws, and CVE-2026-3418 (9.1) related to arbitrary file uploads. No confirmed exploitations have occurred yet, and patches are available. It's advised that administrators update their systems to the latest versions.
How the story developed
6 articles from 4 outlets since 30 Jun. Quiet since 25 Sep. This was the 2nd report, 38 days after the first.
- Tue 30 Jun, 04:11 UTC. SecurityOnline, first report. WSO2 patches critical JWT bypass flaw, putting bank APIs at risk. Cites a CVE in CISA KEV.
- Fri 7 Aug, 14:02 UTC. SecurityOnline. WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged. Cites a CVE in CISA KEV. This article, 2nd of 6.
- Wed 16 Sep, 09:00 UTC. SecurityWeek, its first report on the story. Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets. Cites a CVE in CISA KEV.
- Thu 24 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Exploits Targeting Critical WSO2 Flaw. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. CISA Warns of Exploited WSO2 and Adobe Commerce Flaws. Cites a CVE in CISA KEV.
- Fri 25 Sep, 09:30 UTC. Security Affairs, its first report on the story. CISA Flags Critical WSO2 and Magento Flaws Used in Attacks. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Tue 30 JunDay 01
- WSO2 patches critical JWT bypass flaw, putting bank APIs at risk04:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
Quiet for 5 weeks
Fri 7 AugDay 381- WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch Urged14:02 · SecurityOnline · Picked up again · Known exploited CVE · This article, 2nd of 6
Quiet for 6 weeks
Wed 16 SepDay 781- Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets09:00 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 8 days
Thu 24 SepDay 861- CISA Warns of Active Exploits Targeting Critical WSO2 Flaw20:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Fri 25 SepDay 872
- CISA Flags Critical WSO2 and Magento Flaws Used in Attacks09:30 · Security Affairs · Known exploited CVE