On September 15, NIST and CISA finalized NIST IR 8587, a detailed implementation guide for protecting identity tokens from forgery, theft, and misuse. Two days earlier, security researchers watched a critical JWT authentication bypass in WSO2’s API Manager get exploited in the wild, with forged tokens carrying baked in administrator privileges arriving at honeypots on September 13. The timing is not a coincidence to point at, it is a pattern: the industry keeps finishing its homework on identity token security right as attackers demonstrate why the homework was overdue.
The playbook is not wrong
NIST IR 8587 is a serious document. It gives federal agencies and cloud service providers a genuinely useful architecture for securing single sign-on, identity federation, API access, and machine to machine authentication, covering cryptographic key protection, token revocation, and lifecycle controls in more depth than most enterprises have ever documented for their own environments. Ryan Galluzzo, NIST’s Digital Identity Program Lead, said the report “consolidates insights from across the cybersecurity community to help improve our ability to protect government data, resources and systems from the evolving threats they face today,” and that framing is accurate. The document is not academic. NIST built it in direct response to real token theft incidents, including a case involving more than 60,000 stolen emails from a government agency, and Galluzzo noted it applies to “anyone who is using tokens as part of their access management infrastructure,” in government or commercial industry alike.
The strongest counter-argument to what follows is exactly that: guidance documents are not supposed to be real time defenses, and it is unreasonable to expect a consensus implementation standard to move at the speed of a zero day. NIST IR 8587 went through public comment since its December 2025 draft precisely so agencies and vendors could build durable, interoperable controls rather than react to whatever exploit is trending that week. Judging a considered standard against an active exploit’s calendar is, on its face, an unfair comparison.
Media Partner
Except the gap is not about speed
That defense would hold if the WSO2 case were a novel technique the guidance could not have anticipated. It is not. CVE-2026-5430 is a JWT algorithm confusion bug, “JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access,” in WSO2’s own words, a category of flaw the identity community has understood and written about for years. WSO2 published its advisory back in May, fixed the affected API Control Plane, API Manager, Traffic Manager, and Universal Gateway builds, and the CVE still carries a maximum severity score in single tenant deployments. Four months of available patch time did not stop attackers from finding unpatched, internet facing instances to hit in September, and it did not stop administrators from leaving instances unpatched long enough for that to work.
That is the actual gap NIST IR 8587 cannot close by itself: it describes what correct token architecture looks like, but it has no mechanism to make an organization apply a four month old critical patch, rotate a signing configuration that should never have accepted an unsupported algorithm in the first place, or notice a forged administrator token arriving with privileges it was never issued. Those are enforcement and detection failures, not knowledge failures, and CyberTech has already documented the same enforcement gap on the authentication side of this problem, where attackers found it easier to social engineer a passkey prompt than to break passkey cryptography. Good architecture keeps losing to unpatched implementations and unmonitored token issuance, and a playbook that only reaches the organizations already inclined to read it will not change that.
What defenders should take instead
Treat NIST IR 8587 as a checklist for what your identity infrastructure should already assume is compromised, not a document that improves your posture on its own. That means token lifetimes short enough that a stolen or forged token is useless within hours, signing algorithm allowlists enforced at the validation layer rather than left to a library’s default behavior, and logging that flags a token carrying privileges its issuance history cannot justify. CyberTech’s own coverage of GitLab’s fast patch still leaving a gap unfixed made a version of this same point about vulnerability remediation broadly: publishing the fix, or in this case publishing the standard, is the easy half of the job. The WSO2 exploitation proves the harder half, actually enforcing what the guidance describes before an attacker gets there first, is still where identity security keeps losing.
Source: NIST
