Skip to content
Wso2 Identity Server vulnerabilities
-
wso2 api control plane, api manager, identity server +5 more +7 more
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
CVE-2025-12737
8.4 High
-
wso2 api control plane, api manager, identity server +7 more +9 more
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
CVE-2025-15039
9.4 Critical
-
wso2 api control plane, api manager, identity server +5 more +7 more
Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2026-0637
5.4 Medium
-
wso2 api control plane, api manager, enterprise integrator +44 more +46 more
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
CVE-2025-13394
5.4 Medium
-
wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 more
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
CVE-2025-13909
4.3 Medium
-
wso2 identity server, carbon oauth +1 more
Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
CVE-2025-12627
2.4 Low
-
wso2 identity server, carbon identity api server secret management common, carbon identity api server secret management v1 +2 more
Improper Access Control via Secret Type Management API in WSO2 Identity Server
CVE-2025-14779
3.8 Low
-
wso2 identity server, token exchange grant type for oauth +1 more
Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
CVE-2025-11850
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
CVE-2025-13736
3.7 Low
-
wso2 api control plane, api manager, identity server +5 more +7 more
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
CVE-2024-10302
4.0 Medium
-
wso2 api control plane, api manager, identity server +7 more +9 more
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2024-6832
5.9 Medium
-
wso2 api control plane, api manager, identity server +6 more +8 more
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
CVE-2024-8995
4.9 Medium
-
wso2 api control plane, api manager, identity server +2 more
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
CVE-2026-2445
6.1 Medium
-
wso2 api control plane, api manager, identity server +5 more +7 more
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
CVE-2025-8591
6.1 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
CVE-2024-1248
4.8 Medium
-
wso2 api manager, identity server +1 more
Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
CVE-2025-13475
3.5 Low
-
wso2 identity server, carbon magiclink authenticator module +1 more
Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
CVE-2025-10470
8.6 High
-
wso2 identity server, conditional authentication user and roles related functions +1 more
Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
CVE-2025-9973
6.4 Medium
-
wso2 identity server, carbon magiclink authenticator module +1 more
Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
CVE-2025-10908
7.3 High
-
wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 more
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
CVE-2024-0391
5.3 Medium
-
wso2 identity server
Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
CVE-2025-10503
6.1 Medium
-
wso2 identity server
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
CVE-2025-12624
6.0 Medium
-
wso2 api manager, identity server +1 more
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
CVE-2025-6024
6.1 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
CVE-2024-2374
7.5 High
-
wso2 api manager, identity server +1 more
A local user can be impersonated when using federated authentication with Silent JIT Provisioning.
CVE-2024-1524
7.7 High
-
wso2 identity server
Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
CVE-2025-12107
8.4 High
-
wso2 api manager, api control plane, identity server +7 more +9 more
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
CVE-2025-9312
9.8 Critical
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
CVE-2025-6670
8.8 High
-
wso2 api control plane, api manager, enterprise integrator +10 more +12 more
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
CVE-2025-10853
5.2 Medium
-
wso2 api control plane, api manager, identity server +2 more
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
CVE-2025-5770
6.1 Medium
-
wso2 api control plane, api manager, enterprise integrator +15 more +17 more
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
CVE-2025-10907
8.4 High
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
CVE-2025-10713
Fix available
6.5 Medium
-
wso2 api control plane, api manager, enterprise integrator +6 more +8 more
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
CVE-2025-3125
6.7 Medium
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
CVE-2025-5605
4.3 Medium
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
CVE-2025-5350
5.9 Medium
-
wso2 api manager, api manager analytics, api control plane +19 more +21 more
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
CVE-2025-9804
9.6 Critical
-
wso2 api control plane, api manager, identity server +8 more +10 more
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
CVE-2025-10611
9.8 Critical
-
wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 more
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
CVE-2025-1862
6.7 Medium
-
wso2 identity server, identity server as key manager, open banking iam +2 more
Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled
CVE-2025-1396
3.7 Low
-
wso2 identity server, identity server as key manager, open banking iam +2 more
Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
CVE-2025-0672
3.3 Low
-
wso2 identity server
Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow
CVE-2025-0209
6.1 Medium
-
wso2 identity server, identity server as key manager, open banking iam +2 more
Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
CVE-2025-0663
6.8 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more
Content Spoofing in Multiple WSO2 Products via Error Message Injection
CVE-2024-6429
Fix available
4.3 Medium
-
wso2 api manager, enterprise integrator, identity server +4 more +6 more
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
CVE-2024-3511
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +3 more +5 more
Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
CVE-2024-1440
Fix available
5.4 Medium
-
wso2 api manager, enterprise integrator, identity server +7 more +9 more
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2024-8008
Fix available
5.2 Medium
-
wso2 api manager, enterprise integrator, identity server +4 more +6 more
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
CVE-2024-3509
4.3 Medium
-
wso2 identity server, identity server as key manager, open banking iam +2 more +4 more
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
CVE-2024-7073
6.5 Medium
-
wso2 api manager, identity server, identity server as key manager +4 more +6 more
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
CVE-2024-7097
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +4 more +6 more
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
CVE-2024-7096
Fix available
4.2 Medium
- Show olderLoading…