Skip to contentWso2 Identity Server As Key Manager vulnerabilities
- wso2 api control plane, api manager, identity server +5 more +7 moreArbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2025-127378.4 High
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 api control plane, api manager, identity server +5 more +7 moreHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log ForgeryCVE-2026-06375.4 Medium
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-137363.7 Low
- wso2 api control plane, api manager, identity server +5 more +7 moreImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureCVE-2024-103024.0 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-68325.9 Medium
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationCVE-2025-85916.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationCVE-2024-12484.8 Medium
- wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-03915.3 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceCVE-2024-23747.5 High
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsCVE-2025-93129.8 Critical
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionCVE-2025-31256.7 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code ExecutionCVE-2025-18626.7 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 moreUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledCVE-2025-13963.7 Low
- wso2 identity server, identity server as key manager, open banking iam +2 moreAuthentication Bypass in Multiple WSO2 Products via Stale FIDO Credential AssociationCVE-2025-06723.3 Low
- wso2 identity server, identity server as key manager, open banking iam +2 morePotential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-LoginCVE-2025-06636.8 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 more +4 moreUnauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin ServicesCVE-2024-70736.5 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupCVE-2024-70974.3 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 morePrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawCVE-2024-7096Fix available4.2 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityCVE-2023-6911Fix available4.8 Medium
- wso2 api manager, identity server, identity server as key manager +1 more +3 moreReflected XSS vulnerability can be exploited by tampering a request parameter in Authentication...CVE-2023-68386.1 Medium
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attackCVE-2023-6836Fix available4.6 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreXML External Entity (XXE) vulnerability in the file based service provider creation feature of...CVE-2021-426469.1 Critical
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreA reflected XSS issue exists in the Management Console of several WSO2 products. This affects API...CVE-2022-29548Public exploitEPSS 41.1%4.6 Medium
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...CVE-2022-29464In KEVPublic exploitEPSS 100.0%9.8 Critical
- wso2 identity server, api manager, identity server as key manager +1 more +3 moreIn accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to...CVE-2021-367606.1 Medium
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.CVE-2020-17453Public exploitEPSS 26.2%6.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247066.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247058.8 High
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247046.1 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247038.8 High
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through...CVE-2020-144445.4 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through...CVE-2020-144454.4 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through...CVE-2020-144466.1 Medium
- wso2 api manager, api microgateway, identity server as key manager +2 moreIn WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5...CVE-2020-138835.5 Medium
- Show olderLoading…