ACTIVE EXPLOITATION ATTEMPTS TARGET WSO2 API MANAGER JWT BYPASS WITH FORGED ADMIN TOKENS

Summary from the TLDR InfoSec newsletter

WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.