CVE-2026-5430: WSO2 API Manager, unauthenticated admin API

JWT signature verification throws on a non-RSA alg. The pre-patch interceptor swallows that exception and still accepts the claims. An HS256 Bearer with sub=admin reaches Admin and Publisher REST.

Name: CVE-2026-5430: WSO2 API Manager, unauthenticated admin API
Type: N-day analysis
CVE: CVE-2026-5430
CVE Risk: critical
Disclosure Status: public
Vendor: WSO2
Affected: WSO2 API Manager through 4.5.0. Patched in 4.5.0 update 57 (carbon-apimgt PR 13752).
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, wso2, jwt, cwe-347

WSO2 API Manager, unauthenticated admin API

WSO2 API Manager 4.5.0 - WSO2

I am @abraxas_null. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py.

JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch OAuthAuthenticationInterceptor swallows APIManagementException and continues, so Admin/Publisher REST runs with the token claims (sub=admin). HS256, no kid. Vendor test is carbon-apimgt PR 13752 / product-apim PR 14167. 4.5.0 update 57. CISA KEV.

CVE-2026-5430 (NVD). CWE-347. Vendor: WSO2. WSO2 API Manager through 4.5.0. Patched in 4.5.0 update 57 (carbon-apimgt PR 13752).

What an attacker can do

Unauthenticated GET /api/am/admin/v4/tenant-config with a forged HS256 Bearer. 200 JSON. Control GET without a token is 401. That is admin API as whoever you put in sub. Not RCE by itself. Lab does not ship an RCE payload.

How this showed up in the lab

I mapped the interceptor JWT path, then forged HS256 the way the vendor test does. Management REST on 9443.

Fail-controls already in the lab: 401 after carbon-apimgt PR 13752 / listed update levels; reverse shell; RCE payload.

The lab

HTTPS 9443 (also 8243/8280 on the image). WSO2 API Manager 4.5.0 GA without Updates. ./run.sh.

Target only 127.0.0.1:9443 (or the loopback you bound).

Plain text

python3 CVE-2026-5430-Abraxas-Labs.py

That chdirs into lab/ and runs run.sh (compose up, wait for Carbon, then poc.py).