Wso2
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Wso2 product.
RSS Feeds for Wso2 security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Wso2 products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Wso2 Sorted by Most Security Vulnerabilities since 2018
Known Exploited Wso2 Vulnerabilities
The following Wso2 vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| WSO2 Multiple Products Unrestrictive Upload of File Vulnerability |
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. CVE-2022-29464 Exploit Probability: 100.0% |
April 25, 2022 |
The vulnerability CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.
By the Year
In 2026 there have been 41 vulnerabilities in Wso2 with an average score of 6.3 out of ten. Last year, in 2025 Wso2 had 30 security vulnerabilities published. That is, 11 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.35
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 41 | 6.29 |
| 2025 | 30 | 6.63 |
| 2024 | 0 | 0.00 |
| 2023 | 7 | 6.23 |
| 2022 | 8 | 7.40 |
| 2021 | 2 | 6.10 |
| 2020 | 27 | 6.86 |
| 2019 | 11 | 5.08 |
| 2018 | 1 | 5.40 |
It may take a day or so for new Wso2 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Wso2 Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-3418 | Aug 06, 2026 |
WSO2 API Manager: Arbitrary File Upload via REST API, RCE via AuthThe System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution. |
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2026-3415 | Aug 06, 2026 |
External Entity Resolution in WSO2 EI XML Validator enables RCEThe XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2025-14561 | Aug 06, 2026 |
Tenant Isolation Bypass in WSO2 APIM Publisher APIsIn multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. |
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Traffic Manager
And others... |
| CVE-2025-12317 | Aug 06, 2026 |
WSO2 IS Token Invalidation Failure on Role RemovalWhen internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire. |
Wso2 Enterprise Integrator
Wso2 Identity Server
|
| CVE-2025-6508 | Aug 06, 2026 |
Swagger UI Console Override in WSO2 API Publisher (CVE-2025-6508)The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services. |
Wso2 Api Manager
|
| CVE-2024-6541 | Aug 06, 2026 |
WSO2 EI Class Mediator messageContext Injection Privileged Data AccessThe Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products. |
Wso2 Micro Integrator
Wso2 Enterprise Integrator
Wso2 Api Manager
And others... |
| CVE-2026-5430 | Aug 06, 2026 |
WSO2 Identity Server JWT Auth Bypass via Unsupported Alg CVE-2026-5430The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary. |
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2026-1728 | Aug 06, 2026 |
WSO2 Identity Server: Low-Priv Token Enables Admin REST API AbuseTokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it. |
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
And others... |
| CVE-2025-15039 | Aug 06, 2026 |
WSO2 IDS Auth Flow Bypass via Conditional Auth ScriptThe Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps. |
Wso2 Identity Server
Wso2 Api Manager
Wso2 Open Banking Am
And others... |
| CVE-2026-0637 | Aug 06, 2026 |
WSO2 Carbon Event Publisher Log Bypass via Misconfigured AdapterWhen an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access. |
Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2025-13394 | Aug 06, 2026 |
CSRF via GET in WSO2 Carbon Console Ajax ProcessorThe Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines. |
Identity Server
Api Manager
Wso2 Open Banking Iam
And others... |
| CVE-2025-13909 | Aug 06, 2026 |
WSO2 Identity Server PII Leak via OTP Tenant Isolation FlawThe system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers. |
Wso2 Identity Server
Wso2 Carbon Identity Application Authentication Framework
Wso2 Carbon Magiclink Authenticator Module
And others... |
| CVE-2025-12627 | Aug 06, 2026 |
WSO2 IS Improper Refresh Token Handling in Impersonation FlowThe user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization. This results in the continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability by masking the true actor. |
Wso2 Identity Server
Wso2 Carbon Oauth
|
| CVE-2025-14779 | Aug 06, 2026 |
WSO2 Identity Server: Secret Type CM Cascade Deletes Across OrgThe Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators. |
Wso2 Identity Server
Wso2 Carbon Identity Api Server Secret Management Common
Wso2 Carbon Identity Api Server Secret Management V1
And others... |
| CVE-2025-11850 | Aug 06, 2026 |
WSO2 Identity Server Implicit Association Bypass Enables Identity ConfusionWhen secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique. |
Wso2 Identity Server
|
| CVE-2025-13736 | Aug 06, 2026 |
WSO2 Identity Server: Username Enumeration via Multi-Attribute LoginWhen Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information to craft more effective phishing campaigns or social engineering tactics to compromise user accounts or extract sensitive data. |
Identity Server As Key Manager
Identity Server
Wso2 Open Banking Am
And others... |
| CVE-2024-10302 | Aug 06, 2026 |
WSO2 Unvalidated Claims Injection in User SelfSignupThe user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users. |
Wso2 Api Control Plane
Wso2 Traffic Manager
Wso2 Universal Gateway
And others... |
| CVE-2024-6832 | Aug 06, 2026 |
WSO2 Identity Server Account Lockout Bypass via Unreachable User StoreThe account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence. |
Enterprise Integrator
Wso2 Api Control Plane
Wso2 Traffic Manager
And others... |
| CVE-2024-8995 | Aug 06, 2026 |
Auth Code Leakage in WSO2 Identity Server Allows Token AbuseUnused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code. |
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2026-2445 | Jul 20, 2026 |
WSO2 Identity Server XSS via Unsanitized URL ParamThe affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag. |
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Identity Server
And others... |
| CVE-2026-4249 | Jul 06, 2026 |
WSO2 API Gateway JSON DoS via Unvalidated Throttle EventsThe throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations. |
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2025-8591 | Jul 06, 2026 |
Reflected XSS via URL Param in WSO2 API ManagerThe software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking. |
Wso2 Identity Server
Wso2 Api Manager
Wso2 Api Control Plane
And others... |
| CVE-2024-1248 | Jul 04, 2026 |
WSO2 ID Server JIT Provisioning Role Overwrite via Username CollisionThe silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator. |
Api Manager
Identity Server
Identity Server As Key Manager
And others... |
| CVE-2025-13475 | Jul 04, 2026 |
CrossTenant Consent Leakage in WSO2 Identity ServerIn multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy. |
Identity Server
Api Manager
|
| CVE-2026-2053 | Jun 26, 2026 |
WSO2 API Manager WS-Addressing Header InjectionThe WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks. |
Api Manager
|
| CVE-2025-10470 | May 11, 2026 |
WSO2 IdentityServer Magic Link Authenticator DoS via Uncontrolled Memory GrowthThe Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires repeated invalid authentication attempts to trigger. |
Wso2 Identity Server
Wso2 Carbon Magiclink Authenticator Module
|
| CVE-2025-9973 | May 11, 2026 |
WSO2 Identity Server: Organization Context Validation Bypass in Adaptive AuthDue to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations. |
Wso2 Identity Server
Conditional Authentication User Roles Related Functions
|
| CVE-2025-8325 | May 11, 2026 |
WSO2 APIM 3.x RBAC Bypass in Gateway & Internal Service APIsThe software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments. |
Wso2 Api Control Plane
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2025-8154 | May 11, 2026 |
WSO2 API Manager Webhook HTTP Header InjectionIn Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2025-10908 | May 11, 2026 |
Auth Bypass for Locked Accounts via Magic Link in WSO2 Identity ServerDue to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts. |
Wso2 Identity Server
Wso2 Carbon Magiclink Authenticator Module
|
| CVE-2024-0391 | May 11, 2026 |
WSO2 Identity Server: OTP Account Lock State Bypass Allows Username EnumerationThe check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking users into divulging sensitive data, potentially damaging the organization's reputation and leading to regulatory non-compliance and financial consequences. |
Wso2 Identity Server
Wso2 Open Banking Iam
Wso2 Identity Server As Key Manager
And others... |
| CVE-2025-10503 | Apr 29, 2026 |
WSO2 Auth Endpoint XSS via Unvalidated InputThe authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible. |
Wso2 Identity Server
|
| CVE-2025-12624 | Apr 16, 2026 |
WSO2 IS: Unrevoked Access Tokens on Account Lock (CVE-2025-12624)Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire. |
Wso2 Identity Server
|
| CVE-2025-6024 | Apr 16, 2026 |
WSO2 IS Auth Endpoint XSS via Unencoded User InputThe authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies. |
Api Manager
Identity Server
|
| CVE-2024-10242 | Apr 16, 2026 |
WSO2 Identity Server XSS via Auth Endpoint (CVE-2024-10242)The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve information from the browser. However, the impact is limited as session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking. |
Api Manager
|
| CVE-2024-8010 | Apr 16, 2026 |
XXE in WSO2 API Manager Publisher via XML inputThe component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product. |
Wso2 Api Manager
|
| CVE-2024-4867 | Apr 16, 2026 |
XSS in WSO2 API Manager Dev PortalThe WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag. |
Api Manager
|
| CVE-2024-2374 | Apr 16, 2026 |
WSO2 XML External Entity (XXE) In Parser VulnerabilityThe XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources. |
Wso2 Api Manager
Wso2 Identity Server
Wso2 Open Banking Am
And others... |
| CVE-2024-1524 | Feb 24, 2026 |
WSO2 IS Silent JIT Provisioning Vulnerability: Account OverwriteWhen the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when all the preconditions mentioned below are fulfilled could a malicious actor associate a targeted local user account with a federated IDP user account that they control. The Deployment should have: -An IDP configured for federated authentication with Silent JIT provisioning enabled. The malicious actor should have: -A fresh valid user account in the federated IDP that has not been used earlier. -Knowledge of the username of a valid user in the local IDP. -An account at the federated IDP matching the targeted local username. |
Wso2 Api Manager
Wso2 Identity Server
|
| CVE-2025-13590 | Feb 19, 2026 |
RCE via Arbitrary File Upload in REST API (Admin Privileges)A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload. |
Api Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
And others... |
| CVE-2025-12107 | Feb 19, 2026 |
Velocity Templating RCE via Admin-Injected Template SyntaxDue to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information. |
Wso2 Identity Server
|
| CVE-2025-9312 | Nov 18, 2025 |
Authx Bypass in WSO2 Identity Server mTLS Auth FlowA missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificatebased authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected. |
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Traffic Manager
And others... |
| CVE-2025-6670 | Nov 18, 2025 |
WSO2 Carbon Console CSRF via GET in Admin Service State-Changing OpsA Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments. |
Wso2 Traffic Manager
Wso2 Universal Gateway
Wso2 Api Control Plane
And others... |
| CVE-2025-10853 | Nov 05, 2025 |
WSO2 Mgt Console Reflected XSS via Improper Output EncodingA reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking. |
Wso2 Open Banking Iam
Wso2 Api Manager
Wso2 Identity Server
And others... |
| CVE-2025-5770 | Nov 05, 2025 |
XSS in WSO2 Auth Endpoints via Unencoded OutputA reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victims browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector. |
Wso2 Identity Server
Wso2 Api Manager
Wso2 Api Control Plane
And others... |
| CVE-2025-11093 | Nov 05, 2025 |
Arbitrary Code Exec via Unrestricted GraalJS/NashornJS in WSO2 IntegratorsAn arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment. |
Wso2 Micro Integrator
Wso2 Api Manager
Wso2 Enterprise Integrator
And others... |
| CVE-2025-10907 | Nov 05, 2025 |
WSO2 Admin SOAP Services Arbitrary File Upload (RCE)An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services. |
Wso2 Api Manager
Wso2 Open Banking Iam
Wso2 Open Banking Am
And others... |
| CVE-2025-10713 | Nov 05, 2025 |
XXE Vulnerability in WSO2 XML ParserAn XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable. |
Wso2 Enterprise Integrator
Wso2 Api Control Plane
Wso2 Universal Gateway
And others... |
| CVE-2025-3125 | Nov 05, 2025 |
WSO2 Carbon AppUploader Authenticated File Upload Vulnerability (RCE)An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions. |
Wso2 Identity Server
Wso2 Enterprise Integrator
Wso2 Open Banking Iam
And others... |
| CVE-2025-5605 | Oct 24, 2025 |
WSO2 Management Console Auth Bypass via URI ManipulationAn authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details. |
Identity Server
Enterprise Integrator
Api Manager
And others... |