WSO2 Vulnerabilities and Affected Products

Products

WSO2 API Manager64 vulnerabilities
WSO2 Identity Server59 vulnerabilities
WSO2 Identity Server as Key Manager36 vulnerabilities
WSO2 Open Banking IAM34 vulnerabilities
WSO2 API Control Plane33 vulnerabilities
WSO2 Open Banking AM30 vulnerabilities
WSO2 Traffic Manager30 vulnerabilities
WSO2 Universal Gateway29 vulnerabilities
WSO2 Enterprise Integrator23 vulnerabilities
WSO2 Open Banking KM8 vulnerabilities
WSO2 Micro Integrator7 vulnerabilities
WSO2 Carbon API Management Implementation5 vulnerabilities
WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
WSO2 Enterprise Mobility Manager4 vulnerabilities
org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
WSO2 Enterprise Service Bus3 vulnerabilities
WSO2 IS as Key Manager3 vulnerabilities
api_manager2 vulnerabilities
carbon-registry2 vulnerabilities
Email OTP Authenticator2 vulnerabilities
org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
WSO2 API Manager Analytics2 vulnerabilities

WSO2 vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-15039CRITICAL	Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This v… CWE-693Aug 6, 2026	CVSS9.4v3.1	EPSS0.372%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-0637MEDIUM	Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access. CWE-532Aug 6, 2026	CVSS4.4v3.1	EPSS0.113%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13394MEDIUM	Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingl… CWE-352Aug 6, 2026	CVSS5.4v3.1	EPSS0.097%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13736LOW	Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information t… CWE-203Aug 6, 2026	CVSS3.7v3.1	EPSS0.171%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6832MEDIUM	Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores ar… CWE-693Aug 6, 2026	CVSS5.9v3.1	EPSS0.241%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8995MEDIUM	Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and … CWE-613Aug 6, 2026	CVSS4.9v3.1	EPSS0.119%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8591MEDIUM	Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on sessio… CWE-79Jul 6, 2026	CVSS6.1v3.1	EPSS0.161%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1248MEDIUM	Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When the… CWE-298Jul 4, 2026	CVSS4.8v3.1	EPSS0.182%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-2374HIGH	XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploite… CWE-611Apr 16, 2026	CVSS7.5v3.1	EPSS0.377%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-9312CRITICAL	Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP serv… CWE-306Nov 18, 2025	CVSS9.8v3.1	EPSS0.238%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-6670HIGH	Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an aut… CWE-352Nov 18, 2025	CVSS8.8v3.1	EPSS0.218%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10853MEDIUM	Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates… CWE-79Nov 5, 2025	CVSS5.2v3.1	EPSS0.181%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-11093HIGH	Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This m… CWE-94Nov 5, 2025	CVSS8.4v3.1	EPSS0.439%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10907HIGH	Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with admin… CWE-434Nov 5, 2025	CVSS8.4v3.1	EPSS0.556%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10713MEDIUM	XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable. CWE-611Nov 5, 2025	CVSS6.5v3.1	EPSS0.424%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5605MEDIUM	Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details. CWE-290Oct 24, 20251 related artifact	CVSS4.3v3.1	EPSS0.799%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2025-5350MEDIUM	SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, … CWE-79 CWE-918Oct 24, 20251 related artifact	CVSS5.9v3.1	EPSS0.574%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2025-9804CRITICAL	Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. CWE-284Oct 16, 2025	CVSS9.6v3.1	EPSS0.521%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10611CRITICAL	Potential Broken Access Control in Multiple WSO2 Products via System REST APIs Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations. CWE-863Oct 16, 2025	CVSS9.8v3.1	EPSS0.774%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5717MEDIUM	Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to aut… CWE-94Sep 23, 2025	CVSS6.8v3.1	EPSS0.642%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-3511MEDIUM	Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, pote… CWE-863Jun 23, 2025	CVSS4.3v3.1	EPSS0.174%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1440MEDIUM	Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions. CWE-601Jun 2, 2025	CVSS5.4v3.1	EPSS0.202%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8008MEDIUM	Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, … CWE-79Jun 2, 2025	CVSS5.2v3.1	EPSS0.452%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-3509MEDIUM	Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users. W… CWE-79Jun 2, 2025	CVSS4.3v3.1	EPSS0.167%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-7074MEDIUM	Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but p… CWE-434Jun 2, 2025	CVSS6.8v3.1	EPSS11.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX