abraxas/cve-2026-5430Disclosure pack and Python PoC for CVE-2026-5430, a JWT algorithm-confusion flaw in WSO2 API Manager 4.5.0 enabling unauthenticated admin account takeover.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-5430
WSO2 API Manager 4.5.0 - WSO2
I am @abraxas_null. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py.
JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch OAuthAuthenticationInterceptor swallows APIManagementException and continues, so Admin/Publisher REST runs with the token claims (sub=admin). HS256, no kid. Vendor test is carbon-apimgt PR 13752 / product-apim PR 14167. 4.5.0 update 57. CISA KEV.
| CVE | CVE-2026-5430 · CVE.org |
| CWE | CWE-347 |
| CVSS | Critical: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Product | WSO2 API Manager |
| Affected | all versions through 4.5.0 (inclusive) |
| Patched | 4.5.0 update 57 (community: carbon-apimgt PR 13752) and later |
| Auth | unauthenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Unauthenticated GET /api/am/admin/v4/tenant-config with a forged HS256 Bearer. 200 JSON. Control GET without a token is 401. That is admin API as whoever you put in sub. Not RCE by itself. Lab does not ship an RCE payload.
I mapped the interceptor JWT path, then forged HS256 the way the vendor test does. Management REST on 9443.
Fail-controls already in the lab: 401 after carbon-apimgt PR 13752 / listed update levels; reverse shell; RCE payload.
HTTPS 9443 (also 8243/8280 on the image). WSO2 API Manager 4.5.0 GA without Updates. ./run.sh.
Target only 127.0.0.1:9443 (or the loopback you bound).
python3 CVE-2026-5430-Abraxas-Labs.py
That chdirs into lab/ and runs run.sh (compose up, wait for Carbon, then poc.py).
Witness: Unauthenticated 200 JSON from /api/am/admin/v4/tenant-config with forged HS256 Bearer. Control GET without token is 401.
Ways to lose without learning anything:
Update WSO2 API Manager to 4.5.0 update 57 (community: carbon-apimgt PR 13752) or newer. Re-run CVE-2026-5430-Abraxas-Labs.py against the patched build: the forged HS256 must stay 401.
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.