WSO2 Vulnerabilities and Affected Products

Products

WSO2 API Manager64 vulnerabilities
WSO2 Identity Server59 vulnerabilities
WSO2 Identity Server as Key Manager36 vulnerabilities
WSO2 Open Banking IAM34 vulnerabilities
WSO2 API Control Plane33 vulnerabilities
WSO2 Open Banking AM30 vulnerabilities
WSO2 Traffic Manager30 vulnerabilities
WSO2 Universal Gateway29 vulnerabilities
WSO2 Enterprise Integrator23 vulnerabilities
WSO2 Open Banking KM8 vulnerabilities
WSO2 Micro Integrator7 vulnerabilities
WSO2 Carbon API Management Implementation5 vulnerabilities
WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
WSO2 Enterprise Mobility Manager4 vulnerabilities
org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
WSO2 Enterprise Service Bus3 vulnerabilities
WSO2 IS as Key Manager3 vulnerabilities
api_manager2 vulnerabilities
carbon-registry2 vulnerabilities
Email OTP Authenticator2 vulnerabilities
org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
WSO2 API Manager Analytics2 vulnerabilities

WSO2 vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-3418CRITICAL	Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution… CWE-434Aug 6, 2026	CVSS9.1v3.1	EPSS0.521%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3415HIGH	XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible w… CWE-776Aug 6, 2026	CVSS8.7v3.1	EPSS0.342%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-14561CRITICAL	Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. CWE-284Aug 6, 2026	CVSS9.0v3.1	EPSS0.386%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-6508MEDIUM	User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services. CWE-79Aug 6, 2026	CVSS4.3v3.1	EPSS0.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6541MEDIUM	Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized w… CWE-20Aug 6, 2026	CVSS6.8v3.1	EPSS0.256%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-5430CRITICAL	Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:… CWE-347Aug 6, 2026	CVSS10.0v3.1	EPSS0.223%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-1728CRITICAL	Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it. CWE-269Aug 6, 2026	CVSS9.8v3.1	EPSS0.297%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15039CRITICAL	Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This v… CWE-693Aug 6, 2026	CVSS9.4v3.1	EPSS0.372%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-0637MEDIUM	Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access. CWE-532Aug 6, 2026	CVSS4.4v3.1	EPSS0.113%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13394MEDIUM	Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingl… CWE-352Aug 6, 2026	CVSS5.4v3.1	EPSS0.097%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13736LOW	Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information t… CWE-203Aug 6, 2026	CVSS3.7v3.1	EPSS0.171%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10302MEDIUM	Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interfa… CWE-20Aug 6, 2026	CVSS4.0v3.1	EPSS0.174%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6832MEDIUM	Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores ar… CWE-693Aug 6, 2026	CVSS5.9v3.1	EPSS0.241%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8995MEDIUM	Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and … CWE-613Aug 6, 2026	CVSS4.9v3.1	EPSS0.119%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2445MEDIUM	Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as … CWE-79Jul 20, 2026	CVSS6.1v3.1	EPSS0.149%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4249HIGH	Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is… CWE-707Jul 6, 2026	CVSS8.6v3.1	EPSS0.339%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8591MEDIUM	Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on sessio… CWE-79Jul 6, 2026	CVSS6.1v3.1	EPSS0.161%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1248MEDIUM	Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When the… CWE-298Jul 4, 2026	CVSS4.8v3.1	EPSS0.182%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13475LOW	Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify informa… CWE-288Jul 4, 2026	CVSS3.5v3.1	EPSS0.158%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2053HIGH	Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unautho… CWE-918Jun 26, 2026	CVSS8.3v3.1	EPSS0.236%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8325MEDIUM	Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could… CWE-281May 11, 2026	CVSS6.3v3.1	EPSS0.174%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8154MEDIUM	HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie va… CWE-74May 11, 2026	CVSS5.3v3.1	EPSS0.186%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-6024MEDIUM	Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related co… CWE-79Apr 16, 2026	CVSS6.1v3.1	EPSS0.23%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10242MEDIUM	Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve information from the browser. However, the impact is limited as session-related sensitive cookies … CWE-79Apr 16, 2026	CVSS6.1v3.1	EPSS0.24%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8010LOW	XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product. CWE-611Apr 16, 2026	CVSS3.5v3.1	EPSS0.273%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX