A Forged Key Turns Every Lock
On September 24, CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 27. The vulnerability: a JWT authentication bypass in WSO2 API Manager that scores CVSS 10.0 in multi-tenant deployments. The patch has been available since April. Active exploitation began in mid-September.
The flaw is straightforward. WSO2 API Manager’s token validation logic fails to strictly enforce the configured signing algorithm. When presented with a JWT signed using an unsupported algorithm, the validator accepts it instead of rejecting it. An attacker can craft a JWT with sub: admin and full API management scope grants. The gateway treats it as a valid administrator token. No credentials required.
The vulnerability was discovered by the Hacktron Team and disclosed through WSO2 advisory WSO2-2026-5328, published May 3, 2026. Affected versions span WSO2 API Manager 4.1.0 through 4.6.0, along with the API Control Plane, Traffic Manager, and Universal Gateway components.
Twelve Days of Active Exploitation
watchTowr’s honeypot network first captured forged admin JWTs targeting this vulnerability on September 13 — four months after the patch shipped. The captured tokens arrived pre-constructed with sub: admin claims and full API management scope values. The intent, according to watchTowr’s Yordan Ganchev: enumerate the API catalog and extract backend credentials, consumer keys, and secrets for every registered application.
Security Affairs confirmed the CISA KEV addition. No threat actor has been publicly attributed.
Why This Matters for Agent Infrastructure
API gateways are the primary entry point for AI agents accessing enterprise data. An agent that calls an API through a WSO2 gateway trusts that the gateway has authenticated the request. A CVSS 10.0 authentication bypass at the gateway level is a catastrophic failure for that trust model.
The connection to this week’s deadline cascade is structural. Four CISA KEV CVEs — F5 BIG-IP APM (CVE-2026-94127), Check Point VPN (CVE-2026-85102), Check Point Management Server (CVE-2026-93616), and Arista VeloCloud (CVE-2026-93952) — all hit the same BOD 26-04 federal deadline. WSO2 joins that list with a September 27 deadline. The pattern: BOD 26-04 is compressing patch windows to 72 hours for actively exploited vulnerabilities, and the infrastructure layers agents depend on are landing in the catalog faster than most teams can remediate.
What Defenders Should Do
Apply the vendor patches immediately. For community editions, the fixes are available via GitHub PRs. For supported deployments, update levels are documented in the advisory. Restrict network access to management and admin interfaces. Audit logs for accepted JWTs whose header algorithm differs from the configured signing algorithm. The five-month gap between patch and exploitation is the gap attackers are counting on.