Skip to contentWso2 Carbon Identity Application vulnerabilities
- wso2 api manager, carbon identity application, carbon identity core +5 more +7 moreSensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageCVE-2024-64234.0 Medium
- wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 moreExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsCVE-2024-44122.7 Low
- wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 moreUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-58025.3 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 moreInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII ExposureCVE-2025-139094.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High