WSO2’s CVSS 10.0 JWT Bypass Has Been Exploited for 12 Days. The Patch Has Been Out Since April.

A Forged Key Turns Every Lock On September 24, CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 27. The vulnerability: a JWT authentication bypass in WSO2 API Manager that scores CVSS 10.0 in multi-tenant deployments. The patch has been available since April. Active exploitation began in mid-September. […]