{"vulnerability": "CVE-2026-5430", "sightings": [{"uuid": "80690c57-5a9f-4882-ae35-fbc9be6e0a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb", "content": "CVE-2026-5430 - Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover\nCVE ID : CVE-2026-5430\n \n Published : Aug. 6, 2026, 7:33 a.m. | 47\u00a0minutes ago\n \n Description : The JWT authentication mechanism accepts tokens signed with algori...", "creation_timestamp": "2026-08-06T08:34:33.578188Z"}, {"uuid": "87a0b1bf-6f7f-4c44-8c3e-af7732f2bba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117047743616861031", "content": "WSO2 Universal Gateway v4.5.0 & 4.6.0 affected by CRITICAL CVE-2026-5430 (CVSS 10.0). Improper JWT validation enables account takeover. No patch yet \u2014 apply compensating controls. https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-f913080655427dd8 #OffSeq #WSO2 #JWT #Vulnerability", "creation_timestamp": "2026-08-06T09:00:30.800898Z"}, {"uuid": "31dad500-a395-49aa-85f6-56a77d9fe2b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msfojgm2gi26", "content": "CRITICAL vuln: CVE-2026-5430 in WSO2 Universal Gateway (4.5.0/4.6.0) allows JWT auth bypass and full account takeover. No patch \u2014 restrict access & monitor logins. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-5430-cwe-347-improper-validation-of-certificate-with-host-mismatch-in-wso2-wso2-universal-...", "creation_timestamp": "2026-08-06T09:00:33.688442Z"}, {"uuid": "da1382f4-c7e7-447d-a48b-123dd2dfc59b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msfopshjtl2s", "content": "CVE-2026-5430\nThe JWT authentication in [Software Name] can accept tokens signed with unknown algorithms, allowing attackers to gain unauthorized access to the system. This could lead to the compromise of administrative\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-06T09:04:06.494696Z"}, {"uuid": "357b3317-50c0-4279-82f2-485d3006f597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27", "content": "WSO2 patched seven flaws across API Manager and gateways, led by a CVSS 10 JWT auth bypass (CVE-2026-5430). Update WSO2 API Manager now.\n\n#WSO2 #APISecurity #CVE #AuthBypass #Cybersecurity #Infosec", "creation_timestamp": "2026-06-30T02:45:20.842503Z"}, {"uuid": "6929badb-9a39-436b-8c6f-1f5ccb222585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5430", "content": "", "creation_timestamp": "2026-08-06T12:15:04.860463Z"}, {"uuid": "84a48454-f233-44c8-8e37-4d1072187fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpivzdggor26", "content": "\ud83d\udccc CVE-2026-54305 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature ... https://www.cyberhub.blog/cves/CVE-2026-54305", "creation_timestamp": "2026-06-30T11:37:07.542103Z"}, {"uuid": "00d10c1f-936a-4cb0-bbf5-7895c159f991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54309", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mplesml2b72x", "content": "\ud83d\udccc CVE-2026-54309 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint ... https://www.cyberhub.blog/cves/CVE-2026-54309", "creation_timestamp": "2026-07-01T11:07:08.098988Z"}, {"uuid": "c6c0af01-a30b-4855-a821-2ec72f6dbd23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msrjqqnp7w2j", "content": "\ud83d\udccc CVE-2026-5430 - The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to... https://www.cyberhub.blog/cves/CVE-2026-5430", "creation_timestamp": "2026-08-11T02:07:06.921513Z"}, {"uuid": "ba740818-4513-4212-a89e-d43e14d230dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54307", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqm67u2njg2l", "content": "\ud83d\udccc CVE-2026-54307 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow... https://www.cyberhub.blog/cves/CVE-2026-54307", "creation_timestamp": "2026-07-14T12:07:06.248680Z"}, {"uuid": "fb15bb55-1c67-4ea1-9d63-bb0e3c65fe8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msimoieimb2n", "content": "WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.\n\n#WSO2 #AccountTakeover #CVE #APIsecurity #CyberSecurity", "creation_timestamp": "2026-08-07T13:05:34.871245Z"}, {"uuid": "441ad4ab-37f7-4ed1-8ae8-54284faad726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4aq3wk2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:30.162014Z"}, {"uuid": "787fc6c8-848f-4078-ac53-785020325423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl4m22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.048475Z"}, {"uuid": "0dda6218-6691-4f3a-bbc8-87c274a04850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl5lc2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:31.916425Z"}, {"uuid": "fba1d04a-6503-417b-8610-74d496b69f00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl7js2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:32.797233Z"}, {"uuid": "b40bc908-df8a-4a2a-a1af-44f8cac89b13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj22m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:33.694832Z"}, {"uuid": "f06ffa6b-e9da-4cab-a4e2-9b509e56c958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj32m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:34.529646Z"}, {"uuid": "62ae6ae8-8fe4-4666-94de-f7f805aafeef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj42m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:35.373392Z"}, {"uuid": "887a547d-c0d6-4eed-b3aa-39943ff8089e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54305", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4clbie2m", "content": "6/ This follows CVE-2026-54305 from two weeks ago. Another Enterprise access flaw. Different code, same pattern: external identity systems keep mixing up who is who. Every integration point is a potential confusion point. Trust, but verify the issuer. #ZeroTrust #n8n", "creation_timestamp": "2026-07-18T03:46:36.277483Z"}, {"uuid": "feaaf757-a4e7-4184-8ee5-b9fa89c4a87c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54300", "type": "seen", "source": "https://gist.github.com/alon710/108624152e69003362bd827cbabc8c78", "content": "# GHSA-HP3V-MFQW-H74C: GHSA-hp3v-mfqw-h74c: Missing Character Escaping in @astrojs/netlify Remote Image Pattern Configuration\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C\n\n## Summary\nA security vulnerability in @astrojs/netlify allows attackers to bypass remote image path restrictions by leveraging unescaped regular expression metacharacters. The integration adapter fails to sanitize developer-defined pathnames before interpolating them into a configuration JSON file consumed by Netlify's Edge Image CDN. This results in overly permissive matching behavior at the edge routing layer, enabling path-traversal and filter bypasses.\n\n## TL;DR\nThe @astrojs/netlify adapter fails to escape dots and other regular expression metacharacters in developer-defined image pathnames, generating insecure edge configurations that permit attackers to bypass path-level restrictions on Netlify's Image CDN.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-185: Incorrect Regular Expression / CWE-116: Improper Output Escaping\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Filter Bypass / Resource Hijacking\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Astro applications deployed on Netlify using @astrojs/netlify < 8.1.2\n- **@astrojs/netlify**: < 8.1.2 (Fixed in: `8.1.2`)\n\n## Mitigation\n\n- Upgrade @astrojs/netlify integration to version 8.1.2 or higher\n- Avoid utilizing dot characters or special regular expression symbols inside pathnames in astro.config.mjs remotePatterns\n- Restrict the configured remotePatterns hostname to highly specific subdomains or folders to limit bypass surface\n\n**Remediation Steps:**\n1. Run 'npm install @astrojs/netlify@latest' (or equivalent package manager command) to update the package to version 8.1.2 or later\n2. Verify the output by building the project locally using 'npm run build'\n3. Examine the generated '.netlify/v1/config.json' and verify that dots in pathnames are preceded by double backslashes (e.g., '\\\\.')\n\n## References\n\n- [GitHub Security Advisory GHSA-hp3v-mfqw-h74c](https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c)\n- [Related Vulnerability GHSA-529g-xq4f-cw38 (CVE-2026-54300)](https://github.com/advisories/GHSA-529g-xq4f-cw38)\n- [Astro Pull Request #17018](https://github.com/withastro/astro/pull/17018)\n- [Main Astro Repository](https://github.com/withastro/astro)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HP3V-MFQW-H74C) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T04:31:23.737630Z"}, {"uuid": "ab61d562-0778-4e3a-8bf2-e7e86242106a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmlhm4caz2n", "content": "Patch WSO2 API Manager now \u2014 CVE-2026-5430 (CVSS 9.8) lets attackers forge admin JWTs for full account takeover. watchTowr reports active exploitation since 13 Sept. https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T07:10:04.860683Z"}, {"uuid": "2a21f06c-125c-4fb2-85c4-d13358dba545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvmr6nmdtr2v", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:52:26.547109Z"}, {"uuid": "64a0d356-9a96-4d2b-b373-a6281718c42d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://gist.github.com/ichintu/267a83b424137af67bec5f39bcd35594", "content": "This daily threat intelligence digest highlights four critical security updates from September 2026:\n\n\u2022 **Arista EOS (CVE-2026-73447):** Critical (9.4) OS command injection in gNSI Certz/Bootz services allows authenticated users to escalate privileges and fully compromise devices.\n\u2022 **WSO2 API Manager (CVE-2026-5430):** Critical (9.8) JWT signature verification flaw enables forged admin tokens for account takeover; actively exploited in the wild.\n\u2022 **Oracle September 2026 CSPU:** Major patch release addressing 673 vulnerabilities, including several rated CVSS 10.0.\n\u2022 **VeloCloud Edge (CVE-2026-86108):** High (8.0) input validation weakness in management workflows can be abused for elevated OS command execution.\n\n**Recommendation:** Organizations should prioritize immediate patching and threat monitoring for these critical flaws to prevent privilege escalation, account compromise, and active exploitation.", "creation_timestamp": "2026-09-16T08:02:29.847818Z"}, {"uuid": "c7ffe78e-4c32-4ca8-b34b-15e891a37feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvmpw6mheq2z", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager actively exploited in the wild. Forged admin tokens allow full account takeover. Patch now.\nhttps://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T08:29:47.391271Z"}, {"uuid": "a700d96c-a797-4e1c-a4ef-9441d18545b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvmr4lu2hk2p", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:51:16.772716Z"}, {"uuid": "6b104104-c982-4e8c-a7ef-cc2374ce1e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvmr6cq3vx22", "content": "CVE-2026-5430 in WSO2 middleware is being exploited to bypass JWT authentication, enabling account takeover and access to API backends and credentials.\n", "creation_timestamp": "2026-09-16T08:52:14.298485Z"}, {"uuid": "787fc4fc-8796-4aba-9709-fe2bfa9673e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/thehackernews/10066", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-16T09:00:04.032868Z"}, {"uuid": "3212ecd1-c43e-4ec7-94f2-4c5cfd5440ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/CyberDispatch/2964", "content": "Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.", "creation_timestamp": "2026-09-16T10:00:05.375373Z"}, {"uuid": "98e1fbe5-1d16-43bc-90f8-974e942e936e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "content": "A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication", "creation_timestamp": "2026-09-16T10:00:45.367718Z"}, {"uuid": "52531a01-0892-4f8b-9f56-5eab0529e2bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/", "content": "The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.\n\nThe post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.", "creation_timestamp": "2026-09-16T10:00:45.526665Z"}, {"uuid": "7acc8523-f48f-433d-9f67-72b116488951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvmzkw6otj2r", "content": "WSO2 API Manager \u306b\u3001\u7ba1\u7406\u8005\u30c8\u30fc\u30af\u30f3\u507d\u88c5\u306b\u3088\u308b JWT \u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027 (CVE-2026-5430) \u304c\u767a\u898b\u3055\u308c\u3001\u6d3b\u767a\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002(\u2026", "creation_timestamp": "2026-09-16T11:22:28.143872Z"}, {"uuid": "96e13109-4cda-459a-943b-a2be6d3fd6ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117279777014363970", "content": "\ud83e\udd16 CVE-2026-5430 (CVSS 9.8): critical JWT auth bypass in WSO2 API Manager under active exploitation. Attackers forge admin tokens via improper crypto signature verification, leading to full account takeover. Details by watchTowr.\ud83d\udd17 https://thehackernews.com/2026/09/active-exploitation-attempts-target.html#CVE #InfoSec #CyberSec", "creation_timestamp": "2026-09-16T13:59:15.474778Z"}, {"uuid": "1c114730-cf96-4241-9f1b-50b3fa314825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/ViralCyber/26273", "content": "\ud83d\udd34\u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0646\u0642\u0635 \u062f\u0648\u0631 \u0632\u062f\u0646 JWT \u062f\u0631 WSO2 API Manager \u0628\u0627 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc watchTowr \u0627\u0632 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 WSO2 API Manager \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-5430 (\u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f8) \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0628\u0631\u0631\u0633\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a JWT \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0627 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc\u200c\u0646\u0634\u062f\u0647\u060c \u0627\u062c\u0627\u0632\u0647 \u0639\u0628\u0648\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0635\u0627\u062d\u0628 \u06a9\u0627\u0645\u0644 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n\n\u0647\u0627\u0646\u06cc\u200c\u067e\u0627\u062a\u200c\u0647\u0627\u06cc watchTowr \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f3 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc JWT \u062c\u0639\u0644\u06cc \u062d\u0627\u0648\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u067e\u06cc\u0634 \u062a\u0639\u0628\u06cc\u0647\u200c\u0634\u062f\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f4.\u06f1.\u06f0 \u062a\u0627 \u06f4.\u06f6.\u06f0 \u0627\u0632 API Manager\u060c API Control Plane\u060c Traffic Manager \u0648 Universal Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\u0628\u0647 \u06af\u0641\u062a\u0647 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646\u060c \u0627\u06cc\u0646 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0628\u06a9\u200c\u0627\u0646\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u0635\u0631\u0641\u200c\u06a9\u0646\u0646\u062f\u0647 \u0648 \u0627\u0633\u0631\u0627\u0631 \u062a\u0645\u0627\u0645 \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0645\u06a9\u0627\u0646 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u062f\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062f\u0627\u062e\u0644\u06cc \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.\n\n\n\u062c\u0647\u062a \u0645\u0637\u0627\u0644\u0639\u0647 \u06a9\u0627\u0645\u0644 \u062e\u0628\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f\n\n\ud83c\udd94 @TakianCo\n\ud83c\uddee\ud83c\uddf7", "creation_timestamp": "2026-09-16T16:00:03.852808Z"}, {"uuid": "a29e519e-dd70-4193-9176-5b3c769a622a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvnjc6tadd2t", "content": "Critical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-16T16:03:54.361331Z"}, {"uuid": "9cf94fce-84c4-40c8-baa3-b36aaa23b674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5430", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117281560448148242", "content": "\ud83d\udcf0 Critical WSO2 API Flaw Under Active Attack, Exposes Enterprise Data\nCritical auth bypass (CVE-2026-5430, CVSS 10.0) in WSO2 API Manager is now actively exploited. Attackers can take over admin accounts. Patched in April 2026, ensure your systems are updated! #WSO2 #APISecurity #CyberAttack\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-wso2-api-vulnerability-cve-2026-5430-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-16T16:03:15.299603Z"}, {"uuid": "526e3195-1b15-4d7e-9fbb-3fee8d3b21ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvo3jewp2k2d", "content": "Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.\u2026\n#hackernews #news", "creation_timestamp": "2026-09-16T21:30:03.120392Z"}, {"uuid": "ff95bcf9-9dbd-4637-86b6-96debf9ae60c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/ViralCyber/26273", "content": "\ud83d\udd34\u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0646\u0642\u0635 \u062f\u0648\u0631 \u0632\u062f\u0646 JWT \u062f\u0631 WSO2 API Manager \u0628\u0627 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc watchTowr \u0627\u0632 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 WSO2 API Manager \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-5430 (\u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f8) \u062e\u0628\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0628\u0631\u0631\u0633\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 \u0641\u0631\u0627\u06cc\u0646\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a JWT \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0627 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc\u200c\u0646\u0634\u062f\u0647\u060c \u0627\u062c\u0627\u0632\u0647 \u0639\u0628\u0648\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0635\u0627\u062d\u0628 \u06a9\u0627\u0645\u0644 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n\n\u0647\u0627\u0646\u06cc\u200c\u067e\u0627\u062a\u200c\u0647\u0627\u06cc watchTowr \u062f\u0631 \u062a\u0627\u0631\u06cc\u062e \u06f1\u06f3 \u0633\u067e\u062a\u0627\u0645\u0628\u0631\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc JWT \u062c\u0639\u0644\u06cc \u062d\u0627\u0648\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u067e\u06cc\u0634 \u062a\u0639\u0628\u06cc\u0647\u200c\u0634\u062f\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f4.\u06f1.\u06f0 \u062a\u0627 \u06f4.\u06f6.\u06f0 \u0627\u0632 API Manager\u060c API Control Plane\u060c Traffic Manager \u0648 Universal Gateway \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.\n\n\u0628\u0647 \u06af\u0641\u062a\u0647 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646\u060c \u0627\u06cc\u0646 \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u062c\u0639\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0628\u06a9\u200c\u0627\u0646\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0645\u0635\u0631\u0641\u200c\u06a9\u0646\u0646\u062f\u0647 \u0648 \u0627\u0633\u0631\u0627\u0631 \u062a\u0645\u0627\u0645 \u0627\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u0645\u06a9\u0627\u0646 \u062d\u0631\u06a9\u062a \u062c\u0627\u0646\u0628\u06cc \u062f\u0631 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062f\u0627\u062e\u0644\u06cc \u0633\u0627\u0632\u0645\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u0646\u062f.\n\n\n\u062c\u0647\u062a \u0645\u0637\u0627\u0644\u0639\u0647 \u06a9\u0627\u0645\u0644 \u062e\u0628\u0631 \u06a9\u0644\u06cc\u06a9 \u06a9\u0646\u06cc\u062f\n\n\ud83c\udd94 @TakianCo\n\ud83c\uddee\ud83c\uddf7", "creation_timestamp": "2026-09-17T01:00:03.841029Z"}, {"uuid": "d3944e15-b652-43fb-bf94-70c7b7cbb177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/CyberDispatch/2964", "content": "Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.", "creation_timestamp": "2026-09-17T01:00:04.443787Z"}, {"uuid": "f4a0409c-8e5d-425e-81a8-5f4fdf0b316a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://t.me/thehackernews/10066", "content": "\u26a0\ufe0f Forged admin JWTs are being used in WSO2 API Manager exploitation attempts.\n\nCVE-2026-5430 lets unsupported JWT algorithms bypass authentication and can lead to account takeover. Fixes are available.\n\nRead: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "creation_timestamp": "2026-09-17T01:00:04.539372Z"}, {"uuid": "8adbb526-6e08-4bfe-b7c6-dce49886123f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://thehackernews.com/2026/09/active-exploitation-attempts-target.html", "content": "A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication", "creation_timestamp": "2026-09-17T01:00:36.338385Z"}, {"uuid": "d425bb9c-1fe7-48c5-8e25-ace6322e3d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/", "content": "The vulnerability, tracked as CVE-2026-5430, can be exploited to gain access to valuable enterprise data.\n\nThe post Enterprises Warned of Attacks Exploiting WSO2 Vulnerability appeared first on SecurityWeek.", "creation_timestamp": "2026-09-17T01:00:36.494733Z"}, {"uuid": "8cf17ed8-5a37-447c-ba2c-f6c25a30453e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f259b169-f7e7-4be8-9dae-1a7a384eba15", "content": "", "creation_timestamp": "2026-09-17T06:01:19.506128Z"}, {"uuid": "cc55e27e-0e5e-4c93-b8bc-23c16a45410e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5430", "type": "seen", "source": "https://t.me/pphm_HackerNews/3181", "content": "\ud83d\udd34 Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens\n\nA critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,\" according to an advisory released by WSO2 in May 2026. \"Successful exploitation of the vulnerability may lead to unauthorized access, including potential compromise of administrative accounts and full account takeover.\"", "creation_timestamp": "2026-09-17T11:00:04.435073Z"}]}