A critical authentication bypass vulnerability affecting WSO2 API Control Plane versions include WSO2 API Control Plane 4, tracked as CVE-2026-5430 with a CVSS score of 10.0, has been disclosed in WSO2 API management products. This flaw allows remote attackers to take over accounts, including administrative accounts, by exploiting insecure JSON Web Token authentication processing. An unauthenticated attacker can bypass normal authentication checks and gain access to protected application functions, potentially leading to unauthorized access to API management environments, compromise of privileged user accounts, and complete account takeover. The business impact extends beyond the WSO2 deployment itself, as attackers may be able to alter API configurations, create unauthorized users, modify access policies, change API endpoints, or access sensitive data exposed through managed APIs. This vulnerability can be exploited remotely with low complexity, without credentials or user interaction, and affects several currently supported product versions of WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway deployments.
We recommend you to update WSO2 API Control Plane to version 4.1.0.[/subscribe_to_unlock_form]
A critical authentication bypass vulnerability affecting WSO2 API Control Plane versions include WSO2 API Control Plane 4, tracked as CVE-2026-5430 with a CVSS score of 10.0, has been disclosed in WSO2 API management products. This flaw allows remote attackers to take over accounts, including administrative accounts, by exploiting insecure JSON Web Token authentication processing. An unauthenticated attacker can bypass normal authentication checks and gain access to protected application functions, potentially leading to unauthorized access to API management environments, compromise of privileged user accounts, and complete account takeover. The business impact extends beyond the WSO2 deployment itself, as attackers may be able to alter API configurations, create unauthorized users, modify access policies, change API endpoints, or access sensitive data exposed through managed APIs. This vulnerability can be exploited remotely with low complexity, without credentials or user interaction, and affects several currently supported product versions of WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway deployments.
We recommend you to update WSO2 API Control Plane to version 4.1.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]