Wso2 Open Banking Iam vulnerabilities

• wso2 api control plane, api manager, identity server +5 more +7 more Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution CVE-2025-12737 8.4 HighSeptember 3, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVE-2025-15039 9.4 CriticalAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery CVE-2026-0637 5.4 MediumAugust 6, 2026
• wso2 api control plane, api manager, enterprise integrator +44 more +46 more Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions CVE-2025-13394 5.4 MediumAugust 6, 2026
• wso2 api manager, identity server, identity server as key manager +2 more +4 more Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery CVE-2025-13736 3.7 LowAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure CVE-2024-10302 4.0 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks CVE-2024-6832 5.9 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +6 more +8 more Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access CVE-2024-8995 4.9 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification CVE-2025-8591 6.1 MediumJuly 6, 2026
• wso2 api manager, identity server, identity server as key manager +2 more +4 more Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation CVE-2024-1248 4.8 MediumJuly 4, 2026
• wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 more Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery CVE-2024-0391 5.3 MediumMay 11, 2026
• wso2 api manager, identity server, identity server as key manager +2 more +4 more XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service CVE-2024-2374 7.5 HighApril 16, 2026
• wso2 api manager, api control plane, identity server +7 more +9 more Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVE-2025-9312 9.8 CriticalNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services CVE-2025-6670 8.8 HighNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +10 more +12 more Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding CVE-2025-10853 5.2 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +15 more +17 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution CVE-2025-10907 8.4 HighNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVE-2025-10713 Fix available 6.5 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +6 more +8 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution CVE-2025-3125 6.7 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure CVE-2025-5605 4.3 MediumOctober 24, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products CVE-2025-5350 5.9 MediumOctober 24, 2025
• wso2 api manager, api manager analytics, api control plane +19 more +21 more Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs CVE-2025-9804 9.6 CriticalOctober 16, 2025
• wso2 api control plane, api manager, identity server +8 more +10 more Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVE-2025-10611 9.8 CriticalOctober 16, 2025
• wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution CVE-2025-1862 6.7 MediumSeptember 26, 2025
• wso2 identity server, identity server as key manager, open banking iam +2 more Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled CVE-2025-1396 3.7 LowSeptember 26, 2025
• wso2 identity server, identity server as key manager, open banking iam +2 more Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association CVE-2025-0672 3.3 LowSeptember 23, 2025
• wso2 identity server, identity server as key manager, open banking iam +2 more Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login CVE-2025-0663 6.8 MediumSeptember 23, 2025
• wso2 api manager, enterprise integrator, identity server +4 more +6 more Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files CVE-2024-3511 4.3 MediumJune 23, 2025
• wso2 api manager, enterprise integrator, identity server +7 more +9 more Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation CVE-2024-8008 Fix available 5.2 MediumJune 2, 2025
• wso2 identity server, identity server as key manager, open banking iam +2 more +4 more Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services CVE-2024-7073 6.5 MediumJune 2, 2025
• wso2 api manager, identity server, identity server as key manager +4 more +6 more Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup CVE-2024-7097 4.3 MediumMay 30, 2025
• wso2 api manager, identity server, identity server as key manager +4 more +6 more Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw CVE-2024-7096 Fix available 4.2 MediumMay 30, 2025
• wso2 api manager, identity server, identity server as key manager +6 more +8 more Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover CVE-2024-6914 9.8 CriticalMay 22, 2025
• wso2 api manager, enterprise integrator, identity server +6 more +8 more Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This... CVE-2022-29464 In KEVPublic exploit EPSS 100.0% 9.8 CriticalApril 18, 2022