Skip to contentWso2 Identity Server vulnerabilities
- wso2 identity server, identity application management component +1 morePrivilege Escalation via Client Credentials Grant Type in WSO2 Identity ServerCVE-2025-112297.2 High
- wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 morePrivilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)CVE-2026-40529.8 Critical
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationCVE-2025-57696.1 Medium
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersCVE-2025-13974.8 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreContent Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering AttacksCVE-2024-121394.3 Medium
- wso2 identity serverOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksCVE-2024-121414.3 Medium
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsCVE-2024-95174.9 Medium
- wso2 api manager, carbon registry kernel, enterprise integrator +4 more +6 moreOpen Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing AttacksCVE-2024-23725.4 Medium
- wso2 api control plane, api manager, carbon event publisher core +6 more +8 moreInformation Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataCVE-2026-188004.4 Medium
- wso2 identity server, identity server as key manager, identity server keystore rest api commons +2 more +4 moreInformation Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File PathsCVE-2025-136475.8 Medium
- wso2 api manager, carbon user management ui, enterprise integrator +1 more +3 moreReflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 ProductsCVE-2024-70754.6 Medium
- wso2 api manager, carbon identity management, carbon user manager kernel +1 more +3 moreAccount Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-56174.8 Medium
- wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 moreBroken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsCVE-2025-119699.4 Critical
- wso2 identity server, carbon oauth +1 moreIncomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsCVE-2026-66477.4 High
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]CVE-2026-35833.1 Low
- wso2 api control plane, api manager, identity server +2 moreCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsCVE-2026-118546.1 Medium
- wso2 saml2 sso authenticator ui bundle, api manager, carbon ui +4 more +6 moreServer Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesCVE-2025-142608.3 High
- wso2 api manager, carbon identity application, carbon identity core +5 more +7 moreSensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageCVE-2024-64234.0 Medium
- wso2 identity server, carbon oauth +1 moreImproper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessCVE-2025-03267.4 High
- wso2 api manager, carborn identity handler, identity server +3 more +5 moreUsername Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-74785.8 Medium
- wso2 identity serverIncomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksCVE-2024-55634.8 Medium
- wso2 api manager, carbon user management ui, enterprise integrator +4 more +6 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionCVE-2024-51396.1 Medium
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 morePassword Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-23234.8 Medium
- wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 moreExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsCVE-2024-44122.7 Low
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationCVE-2025-131736.5 Medium
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 moreUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryCVE-2025-135915.3 Medium
- wso2 carbon scim 2.0 common component, carbon scim common component, identity server +2 more +4 moreArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverCVE-2025-101498.2 High
- wso2 api control plane, api manager, carbon identity api server configs v1 +5 more +7 moreSensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsCVE-2025-72034.9 Medium
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 moreRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code ExecutionCVE-2024-44579.1 Critical
- wso2 identity serverPotential brute force vulnerability due to non-expiring SMS OTPsCVE-2024-81225.9 Medium
- wso2 identity serverUsername Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account DiscoveryCVE-2025-131663.7 Low
- wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 moreUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-58025.3 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreArbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2025-127378.4 High
- wso2 enterprise integrator, identity server +1 moreImproper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesCVE-2025-123175.0 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 moreInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII ExposureCVE-2025-139094.3 Medium
- wso2 identity server, carbon oauth +1 moreImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsCVE-2025-126272.4 Low
- wso2 identity server, carbon identity api server secret management common, carbon identity api server secret management v1 +2 moreImproper Access Control via Secret Type Management API in WSO2 Identity ServerCVE-2025-147793.8 Low
- wso2 identity server, token exchange grant type for oauth +1 moreImproper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]CVE-2025-118504.3 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-137363.7 Low
- wso2 api control plane, api manager, identity server +5 more +7 moreImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureCVE-2024-103024.0 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-68325.9 Medium
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationCVE-2026-24456.1 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationCVE-2025-85916.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationCVE-2024-12484.8 Medium
- wso2 api manager, identity server +1 moreCross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data ExposureCVE-2025-134753.5 Low
- wso2 identity server, carbon magiclink authenticator module +1 moreDenial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service UnavailabilityCVE-2025-104708.6 High
- wso2 identity server, conditional authentication user and roles related functions +1 moreAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account TakeoverCVE-2025-99736.4 Medium
- Show moreLoading…