Critical WSO2 API Manager Flaw Allows Auth Bypass via Forged JWT Tokens

·1 views

A critical authentication bypass vulnerability, CVE-2026-5430, has been identified in WSO2 API Manager and related products, carrying a maximum CVSS score of 10.0. The flaw allows unauthenticated attackers to forge JSON Web Tokens using unsupported signing algorithms, bypassing authentication entirely. Security firm watchTowr detected initial exploitation attempts on September 13, 2026, and confirmed the bypass grants access to API backend destinations, credentials, and registered application secrets. Successful exploitation could enable administrator account takeover and serve as a launchpad for lateral movement into internal services. WSO2 has issued a security advisory urging organizations to apply product-specific updates or community edition patches immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Six Data Errors Later, a Digital Twin Yields Fiskardo's Real Evacuation Time

A geospatial analysis using pgRouting's Dijkstra algorithm was conducted to estimate road evacuation time from Fiskardo, a village on the Greek island of Kefalonia, in a wildfire scenario. The process uncovered six successive errors, including a stale road network table, a mislabeled cost column conflating meters with minutes, mismatched coordinate reference systems, and unsorted query results. A suspected connectivity gap in the coastal road data caused the router to favour a 29 km inland mountain route over a 15 km coastal alternative. After correcting all identifiable errors, the analysis concluded that evacuation to Agia Effimia Marina would take approximately 44 minutes across 116 road segments. The exercise highlights that in safety-critical geospatial work, a result's value lies in how rigorously it has been stress-tested, not merely in whether the query executes successfully.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Semrush Study: AI Citation Sources Shift Based on Query Type and User Intent

Semrush has released a focused mini study examining how AI platforms select citation sources differently depending on query type and user intent. The research, part of the company's AI Visibility Index initiative and backed by 126 million prompts, compares citation patterns for high-stakes YMYL queries against everyday commercial queries. Four platforms were assessed — ChatGPT, Google AI Mode, Google AI Overview, and Gemini — across 22 topics using US data with a UK cross-check. The study found that government sources, community content, and brand-owned domains each appear at different rates depending on the nature and intent of a query. Semrush concludes that optimising for AI citation visibility requires a context-specific strategy rather than a single universal content approach.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Web3 Economic Activity Builds Businesses Layer by Layer

A new framework for understanding Web3 proposes mapping the ecosystem by economic activity rather than by blockchain infrastructure. The model identifies nine layers, starting from destination applications like trading and lending platforms at the top, down to base blockchain settlement infrastructure at the bottom. Successful applications such as Uniswap, Aave, and Polymarket generate demand that spawns businesses across adjacent layers, including data tools, risk management, wallets, and developer infrastructure. Each layer exists because real user activity at higher levels creates problems that need solving, making application adoption the engine of the broader ecosystem. The framework also notes that capital, liquidity, and autonomous software cut across all layers, and that many companies intentionally operate at multiple levels simultaneously.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Interactive Simulators Help Developers Master TLS Handshakes and OAuth Flows

Two free browser-based simulators aim to help backend developers learn the TLS handshake and OAuth authorization code flow by stepping through each sequence interactively, rather than studying static diagrams. The TLS simulator covers both TLS 1.2 and 1.3 protocols, highlighting key differences such as the single round trip and post-ServerHello encryption introduced in 1.3, while also letting users simulate failure scenarios like expired certificates, hostname mismatches, and untrusted certificate chains. The OAuth simulator walks developers through the full authorization code flow with PKCE, covering every party — the app, user, authorization server, and API — and showing exactly what data moves across each channel. A core learning point is understanding which secrets, such as the authorization code versus tokens, are exposed in the browser-facing channel versus the back-channel token exchange. Both tools require no signup and are intended to build the kind of hands-on familiarity that helps developers debug real-world security errors under pressure.

0 comments Read more at DEV Community