Wso2
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Wso2 product.
RSS Feeds for Wso2 security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Wso2 products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Wso2 Sorted by Most Security Vulnerabilities since 2018
Known Exploited Wso2 Vulnerabilities
The following Wso2 vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| WSO2 Multiple Products Path Traversal Vulnerability |
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. CVE-2026-5430 |
September 24, 2026 |
| WSO2 Multiple Products Unrestrictive Upload of File Vulnerability |
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. CVE-2022-29464 Exploit Probability: 100.0% |
April 25, 2022 |
The vulnerability CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.
By the Year
In 2026 there have been 84 vulnerabilities in Wso2 with an average score of 6.1 out of ten. Last year, in 2025 Wso2 had 30 security vulnerabilities published. That is, 54 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.52
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 84 | 6.12 |
| 2025 | 30 | 6.63 |
| 2024 | 0 | 0.00 |
| 2023 | 7 | 6.23 |
| 2022 | 8 | 7.40 |
| 2021 | 2 | 6.10 |
| 2020 | 27 | 6.86 |
| 2019 | 11 | 5.08 |
| 2018 | 1 | 5.40 |
It may take a day or so for new Wso2 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Wso2 Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2025-11229 | Nov 04, 2026 |
WSO2 Identity Server: Scope Escalation via authorize_all_scopes (CVE-2025-11229)The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state. |
Wso2 Identity Server
Wso2 Identity Application Management Component
|
| CVE-2026-4052 | Nov 03, 2026 |
WSO2 Identity Server Resident Key Manager DB Sharing Token AbuseThis issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint. |
Api Manager
Wso2 Api Control Plane
Identity Server
And others... |
| CVE-2025-5769 | Nov 03, 2026 |
WSO2 Identity Server XSS in Auth Endpoint Allows JS InjectionThe authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible. |
Wso2 Api Control Plane
Wso2 Api Manager
Wso2 Identity Server
And others... |
| CVE-2025-1397 | Nov 03, 2026 |
WSO2 Identity Server JWT/SAML Bearer Grant Tokens Issued for Disabled IDPsWhen utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state. |
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Manager
And others... |
| CVE-2024-12139 | Nov 02, 2026 |
WSO2 ID Server Error Msg Injection via URL ParamsThe error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions. |
Wso2 Api Manager
Wso2 Identity Server
Wso2 Identity Server As Key Manager
And others... |
| CVE-2024-12141 | Nov 02, 2026 |
WSO2 Identity Server Callback URL Validation Bypass (CVE-2024-12141)The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft. |
Wso2 Identity Server
|
| CVE-2024-9517 | Nov 02, 2026 |
WSO2 Access Token Bypass via Refresh Token GrantThe refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2024-2372 | Nov 02, 2026 |
WSO2 Identity Server Open Redirection via URL ConstructionThe affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm. |
Wso2 Open Banking Am
Wso2 Api Manager
Wso2 Identity Server As Key Manager
And others... |
| CVE-2025-12544 | Nov 02, 2026 |
WSO2 API Manager Publisher: SVG Upload XSS via Publisher RoleThe Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking. |
Api Manager
|
| CVE-2026-2613 | Nov 02, 2026 |
WSO2 Identity Server Admin API Blind SQLi via Unescaped InputThe Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service. |
Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2026-18800 | Nov 02, 2026 |
WSO2 Carbon Event Pub Adapter Logs Sensitive PropsWhen an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets. |
Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2025-13647 | Nov 02, 2026 |
WSO2 Component Content-Type Validation Bypass Causing Cert Path DisclosureThe affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system. |
Identity Server
Wso2 Open Banking Iam
Identity Server As Key Manager
And others... |
| CVE-2024-7075 | Nov 02, 2026 |
WSO2 Management Console XSS via Unencoded User Search InputThe user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented. |
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Identity Server
And others... |
| CVE-2024-5617 | Nov 02, 2026 |
WSO2 Identity Server Account Lockout Failure Allows BruteForceThe account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts. |
Wso2 Api Manager
Wso2 Identity Server
Wso2 Carbon Identity Management
And others... |
| CVE-2025-11969 | Nov 02, 2026 |
WSO2 API Manager: REST API Access Control Bypass (CVE-2025-11969)The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability. |
Api Manager
Identity Server As Key Manager
Wso2 Open Banking Am
And others... |
| CVE-2026-78674 | Oct 28, 2026 |
Arbitrary Command Exec via Unvalidated Input in WSO2 BPMN REST APIThe BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account. |
Enterprise Integrator Bps Profile
Business Process Server
|
| CVE-2026-6647 | Oct 28, 2026 |
WSO2 Identity Server: OAuth Revocation Fails with CaseInsensitive User StoreIn deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated. A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls. |
Wso2 Identity Server
Wso2 Carbon Oauth
|
| CVE-2026-3583 | Oct 28, 2026 |
Cache Invalidation Bug Lets Revoked Tokens Reappear in WSO2 OAuth2When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows. |
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Universal Gateway
And others... |
| CVE-2026-11854 | Oct 28, 2026 |
WSO2 IS XSS via Auth Endpoint Reflected ErrorThe authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible. |
Api Manager
Wso2 Api Control Plane
Identity Server
And others... |
| CVE-2025-14260 | Oct 28, 2026 |
WSO2 SSRF via Unvalidated Resource Location InputDue to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product. |
Wso2 Api Manager
Wso2 Identity Server As Key Manager
Wso2 Open Banking Am
And others... |
| CVE-2024-6423 | Oct 21, 2026 |
WSO2 API Manager Sensitive Data Logged via URL ParametersThe product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly. |
Wso2 Api Manager
Wso2 Open Banking Am
Wso2 Identity Server
And others... |
| CVE-2025-0326 | Oct 21, 2026 |
WSO2 Identity Server Token Invalidation Failure Allows Persistent AccessThe system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors. |
Identity Server
Wso2 Carbon Oauth
|
| CVE-2024-7478 | Oct 21, 2026 |
WSO2 Identity Server Username Enumeration via External User StoreWhen a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions. |
Wso2 Api Manager
Wso2 Identity Server As Key Manager
Wso2 Identity Server
And others... |
| CVE-2024-5563 | Oct 21, 2026 |
WSO2 Identity Server reCaptcha Bypass in Auth FlowsDue to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations. |
Identity Server
|
| CVE-2024-4989 | Oct 21, 2026 |
WSO2 API Manager Open Redirect via callback URL vulnerabilityThe callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm. |
Api Manager
|
| CVE-2024-5139 | Oct 21, 2026 |
XSS in WSO2 Identity Server Auth Endpoint Unsafe JavaScript InjectionThe Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible. |
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Api Manager
And others... |
| CVE-2024-2323 | Oct 20, 2026 |
WSO2 IS RemoteUserStoreManagerService Password History Bypass Allows Brute-ForceThe RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise. |
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Api Manager
And others... |
| CVE-2024-4412 | Oct 19, 2026 |
WSO2 Identity Server EL Injection via Unvalidated InputThe software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations. |
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Open Banking Iam
And others... |
| CVE-2025-13173 | Oct 19, 2026 |
WSO2 IS Session-Token Revocation Failure (SSO)Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data. |
Wso2 Api Control Plane
Wso2 Universal Gateway
Wso2 Api Manager
And others... |
| CVE-2025-13591 | Oct 19, 2026 |
WSO2 Identity Server Username Enumeration via Auth ResponseThe authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns. |
Wso2 Identity Server
Wso2 Carbon Abstract Otp Authenticator
Email Otp Authenticator
And others... |
| CVE-2025-10149 | Oct 19, 2026 |
SCIM Auth Bypass in WSO2 Identity Server Federated User SpoofingThe SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity. |
Wso2 Identity Server As Key Manager
Wso2 Open Banking Iam
Wso2 Identity Server
And others... |
| CVE-2025-7203 | Oct 19, 2026 |
WSO2 Identity Server: Credential Exposure via PlainText LogsThe Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server. |
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2025-7043 | Oct 19, 2026 |
ForgeRock OIDC Client Refresh-Token -> Access Token ExploitThe ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Api Control Plane
And others... |
| CVE-2025-6623 | Oct 19, 2026 |
WSO2 Carbon: XSS via Unencoded XML Input in Carbon ConsoleThe carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2024-4457 | Oct 18, 2026 |
WSO2 Identity Server JDBC User Store RCE via Input Validation BypassThe Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system. |
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Open Banking Am
And others... |
| CVE-2024-8122 | Oct 08, 2026 |
WSO2 Identity Server OTP Expiry Bypass - Brute Force MFA BypassThe WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP. The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system. |
Wso2 Identity Server
|
| CVE-2025-13166 | Sep 15, 2026 |
WSO2 Identity Server: Username Enum via SMS OTP Error LeakageThe SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance. |
Identity Server
Wso2 Identity Server
|
| CVE-2025-5802 | Sep 15, 2026 |
WSO2 IS Username Enumeration via Self-RegistrationThe self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns. |
Api Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
And others... |
| CVE-2026-19515 | Sep 15, 2026 |
WSO2 MI VS Code Extension OS Command Injection via Untrusted ProjectThe WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution. |
Wso2 Integrator Mi Visual Studio Code
|
| CVE-2026-4103 | Sep 14, 2026 |
WSO2 API Manager XSS: untrusted user input in Publisher/Developer PortalInsufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges. |
Wso2 Api Control Plane
Wso2 Api Manager
|
| CVE-2026-3096 | Sep 10, 2026 |
WSO2 Identity Server Open Tabs Window.opener Exploit (CVE-2026-3096)The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site. |
Wso2 Api Control Plane
Wso2 Api Manager
|
| CVE-2025-12737 | Sep 03, 2026 |
WSO2 Carbon Console Admin RCE via Input InjectionThe administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system. |
Wso2 Open Banking Am
Wso2 Open Banking Iam
Wso2 Traffic Manager
And others... |
| CVE-2026-3416 | Sep 03, 2026 |
WSO2 API Manager API Publisher PRNG Weakens Webhook HMAC SecretsThe API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification. Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise. |
Wso2 Api Manager
Wso2 Api Control Plane
|
| CVE-2026-3418 | Aug 06, 2026 |
WSO2 API Manager: Arbitrary File Upload via REST API, RCE via AuthThe System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution. |
Wso2 Api Manager
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |
| CVE-2026-3415 | Aug 06, 2026 |
External Entity Resolution in WSO2 EI XML Validator enables RCEThe XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product. |
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
And others... |
| CVE-2025-14561 | Aug 06, 2026 |
Tenant Isolation Bypass in WSO2 APIM Publisher APIsIn multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. |
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Traffic Manager
And others... |
| CVE-2025-12317 | Aug 06, 2026 |
WSO2 IS Token Invalidation Failure on Role RemovalWhen internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire. |
Wso2 Enterprise Integrator
Wso2 Identity Server
|
| CVE-2025-6508 | Aug 06, 2026 |
Swagger UI Console Override in WSO2 API Publisher (CVE-2025-6508)The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services. |
Wso2 Api Manager
|
| CVE-2024-6541 | Aug 06, 2026 |
WSO2 EI Class Mediator messageContext Injection Privileged Data AccessThe Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products. |
Wso2 Micro Integrator
Wso2 Enterprise Integrator
Wso2 Api Manager
And others... |
| CVE-2026-5430 | Aug 06, 2026 |
WSO2 Identity Server JWT Auth Bypass via Unsupported Alg CVE-2026-5430The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary. |
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
And others... |