WSO2 API Manager JWT bypass sees active exploitation attempts

Image: Primary

Published Wednesday, September 16, 2026 · 10:07 AM EDT

A critical JWT-signature verification flaw in WSO2 API Manager and related products is seeing active exploitation attempts, according to watchTowr. The flaw, CVE-2026-5430, can allow tokens signed with unsupported algorithms to bypass authentication and potentially take over administrative accounts. WatchTowr said its honeypots captured tokens with embedded administrator privileges on September 13. WSO2 has released fixes for affected products and support-subscription update levels.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security

Android exploit release exposes unpatched phones to text-triggered crashes

Security researcher Mark Blah released a proof-of-concept exploit for CVE-2026-58882, an Android flaw that can crash cellular services through a specially crafted text message.

AI Science

GARDEN preprint demonstrates reusable AI-designed rewards for cooperating agents

Researchers report in a preprint that GARDEN, a system that uses a language model to design rewards for cooperating agents, improved performance when its reward programs transferred unchanged to related scenarios unseen during design.

Infrastructure Products

Intel redirects planned PC chip capacity toward Xeon production

Intel is reallocating manufacturing resources from client processors to server CPUs as demand exceeds supply, Tom's Hardware reported, citing company executives.

Products Policy

Binance seeks licensed return to Malaysia through regulatory talks

Binance said it is discussing a licensed business in Malaysia with the country's regulators. The cryptocurrency exchange is seeking a route back into a market where authorities have blocked its website and applications. The discussions concern access through a licensed operation.

Science Security

Security benchmark finds combined static and AI reviews catch 101 of 108 flaws

A preprint evaluating security tools found that combining Snyk Code with Claude Code using Opus 5 at xhigh effort detected 101 of 108 reference vulnerabilities. Individually, the tools found 89 and 85 respectively.

Robotics

Meta reportedly builds humanoid prototype with Fourier

Meta has built a working humanoid robot prototype with Chinese robotics company Fourier and is developing a second version, The Information reported, citing people familiar with the project. The first prototype reportedly took about three months to build.