abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  CVE-2026-5430

CVE-2026-5430

WSO2 API Manager 4.5.0 - WSO2

I am @abraxas_null. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py.

JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch OAuthAuthenticationInterceptor swallows APIManagementException and continues, so Admin/Publisher REST runs with the token claims (sub=admin). HS256, no kid. Vendor test is carbon-apimgt PR 13752 / product-apim PR 14167. 4.5.0 update 57. CISA KEV.

CVE	CVE-2026-5430 · CVE.org
CWE	CWE-347
CVSS	Critical: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Product	WSO2 API Manager
Affected	all versions through 4.5.0 (inclusive)
Patched	4.5.0 update 57 (community: carbon-apimgt PR 13752) and later
Auth	unauthenticated
License	GNU Affero GPL v3.0
Lab	127.0.0.1 only

---

What an attacker can do

Unauthenticated GET /api/am/admin/v4/tenant-config with a forged HS256 Bearer. 200 JSON. Control GET without a token is 401. That is admin API as whoever you put in sub. Not RCE by itself. Lab does not ship an RCE payload.

---

How I found it

I mapped the interceptor JWT path, then forged HS256 the way the vendor test does. Management REST on 9443.

Fail-controls already in the lab: 401 after carbon-apimgt PR 13752 / listed update levels; reverse shell; RCE payload.

---

The lab

HTTPS 9443 (also 8243/8280 on the image). WSO2 API Manager 4.5.0 GA without Updates. ./run.sh.

• lab/Dockerfile
• lab/docker-compose.yml
• lab/run.sh
• lab/poc.py

Target only 127.0.0.1:9443 (or the loopback you bound).

python3 CVE-2026-5430-Abraxas-Labs.py

That chdirs into lab/ and runs run.sh (compose up, wait for Carbon, then poc.py).

Witness: Unauthenticated 200 JSON from /api/am/admin/v4/tenant-config with forged HS256 Bearer. Control GET without token is 401.

Ways to lose without learning anything:

• 401 after carbon-apimgt PR 13752 / listed update levels
• reverse shell
• RCE payload

---

The fix

Update WSO2 API Manager to 4.5.0 update 57 (community: carbon-apimgt PR 13752) or newer. Re-run CVE-2026-5430-Abraxas-Labs.py against the patched build: the forged HS256 must stay 401.

---

References

• CVE-2026-5430 · NVD

• CVE-2026-5430 · CVE.org

• security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

• github.com/wso2/carbon-apimgt/pull/13752

• github.com/wso2/product-apim/pull/14167

• www.cve.org/CVERecord?id=CVE-2026-5430

• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

---

License

GNU Affero GPL v3.0. See LICENSE.

---

The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null