WSO2 vulnerabilities

Products

• api manager 95
• WSO2 API Manager 95
• WSO2 Identity Server 88
• identity server 83
• WSO2 Identity Server as Key Manager 54
• identity server as key manager 52
• WSO2 API Control Plane 51
• WSO2 Open Banking IAM 51
• WSO2 Open Banking AM 45
• WSO2 Traffic Manager 40
• WSO2 Universal Gateway 40
• enterprise integrator 33
• open banking iam 33
• api control plane 31
• WSO2 Enterprise Integrator 29
• traffic manager 27
• open banking am 26
• universal gateway 26
• api manager analytics 11
• api microgateway 11
• identity server analytics 11
• open banking km 9
• WSO2 Carbon OAuth 8
• WSO2 Open Banking KM 8
• data analytics server 7
• iot server 7
• WSO2 Micro Integrator 7
• WSO2 Carbon API Management Implementation 6
• micro integrator 5
• WSO2 Carbon API Manager Rest API Utility 5

Latest WSO2 CVEs

Newest publication first · page 1 of 8

1. CVE-2025-11229 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

   Published 2026-11-04

   High·CVSS 7.2 EPSS 0.36%

   The system fails to properly enforce scope authorization when the authorize_all_scopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit...

2. CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

   Published 2026-11-03

   Critical·CVSS 9.8 EPSS 0.36%

   This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Serve...

3. CVE-2025-5769 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

   Published 2026-11-03

   Medium·CVSS 6.1 EPSS 0.18%

   The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser....

4. CVE-2025-1397 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

   Published 2026-11-03

   Medium·CVSS 4.8 EPSS 0.15%

   When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could levera...

5. CVE-2024-12139 Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

   Published 2026-11-02

   Medium·CVSS 4.3 EPSS 0.21%

   The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious...

6. CVE-2024-12141 Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

   Published 2026-11-02

   Medium·CVSS 4.3 EPSS 0.20%

   The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects...

7. CVE-2024-9517 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

   Published 2026-11-02

   Medium·CVSS 4.9 EPSS 0.18%

   The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mech...

8. CVE-2024-2372 Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

   Published 2026-11-02

   Medium·CVSS 5.4 EPSS 0.20%

   The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vu...

9. CVE-2025-12544 Stored Cross-Site Scripting in Multiple WSO2 Products

   Published 2026-11-02

   Medium·CVSS 4.8 EPSS 0.20%

   The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security co...

10. CVE-2026-2613 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

    Published 2026-11-02

    High·CVSS 8.7 EPSS 0.42%

    The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL inject...

11. CVE-2026-18800 Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

    Published 2026-11-02

    Medium·CVSS 4.4 EPSS 0.16%

    When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of...

12. CVE-2025-13647 Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths

    Published 2026-11-02

    Medium·CVSS 5.8 EPSS 0.18%

    The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header. Successful exploitation can lead to the unintended expo...

13. CVE-2024-7075 Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products

    Published 2026-11-02

    Medium·CVSS 4.6 EPSS 0.20%

    The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Succe...

14. CVE-2024-5617 Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

    Published 2026-11-02

    Medium·CVSS 4.8 EPSS 0.22%

    The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such s...

15. CVE-2025-11969 Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

    Published 2026-11-02

    Critical·CVSS 9.4 EPSS 0.32%

    The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could ena...

16. CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

    Published 2026-10-28

    High·CVSS 8.8 EPSS 1.00%

    The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands...

17. CVE-2026-6647 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

    Published 2026-10-28

    High·CVSS 7.4 EPSS 0.21%

    In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify user...

18. CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

    Published 2026-10-28

    Low·CVSS 3.1 EPSS 0.26%

    When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation reque...

19. CVE-2026-11854 Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

    Published 2026-10-28

    Medium·CVSS 6.1 EPSS 0.21%

    The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exp...

20. CVE-2025-14260 Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

    Published 2026-10-28

    High·CVSS 8.3 EPSS 0.28%

    Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available throu...

21. CVE-2024-6423 Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

    Published 2026-10-21

    Medium·CVSS 4.0 EPSS 0.10%

    The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user...

22. CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

    Published 2026-10-21

    High·CVSS 7.4 EPSS 0.27%

    The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even a...

23. CVE-2024-7478 Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

    Published 2026-10-21

    Medium·CVSS 5.8 EPSS 0.24%

    When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different usernam...

24. CVE-2024-5563 Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

    Published 2026-10-21

    Medium·CVSS 4.8 EPSS 0.19%

    Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized acce...

25. CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

    Published 2026-10-21

    Medium·CVSS 5.4 EPSS 0.17%

    The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.