Skip to contentWso2 Open Banking Am vulnerabilities
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersCVE-2025-13974.8 Medium
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsCVE-2024-95174.9 Medium
- wso2 api manager, carbon registry kernel, enterprise integrator +4 more +6 moreOpen Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing AttacksCVE-2024-23725.4 Medium
- wso2 api control plane, api manager, carbon event publisher core +6 more +8 moreInformation Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataCVE-2026-188004.4 Medium
- wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 moreBroken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsCVE-2025-119699.4 Critical
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]CVE-2026-35833.1 Low
- wso2 saml2 sso authenticator ui bundle, api manager, carbon ui +4 more +6 moreServer Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesCVE-2025-142608.3 High
- wso2 api manager, carbon identity application, carbon identity core +5 more +7 moreSensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageCVE-2024-64234.0 Medium
- wso2 api manager, carborn identity handler, identity server +3 more +5 moreUsername Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-74785.8 Medium
- wso2 api manager, carbon user management ui, enterprise integrator +4 more +6 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionCVE-2024-51396.1 Medium
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 morePassword Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-23234.8 Medium
- wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 moreExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsCVE-2024-44122.7 Low
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationCVE-2025-131736.5 Medium
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 moreRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code ExecutionCVE-2024-44579.1 Critical
- wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 moreUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-58025.3 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreArbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2025-127378.4 High
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-137363.7 Low
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-68325.9 Medium
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationCVE-2025-85916.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationCVE-2024-12484.8 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceCVE-2024-23747.5 High
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsCVE-2025-93129.8 Critical
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)CVE-2025-110938.4 High
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationCVE-2025-10713Fix available6.5 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 api control plane, api manager, open banking am +2 more +4 moreAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin ServiceCVE-2025-57176.8 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 api manager, carbon synapse artifact uploader be, enterprise integrator +4 more +6 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionCVE-2024-7074EPSS 17.7%6.8 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupCVE-2024-70974.3 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 morePrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawCVE-2024-7096Fix available4.2 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, enterprise integrator, enterprise service bus +2 more +4 moreAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsCVE-2025-2905Fix available9.1 Critical
- wso2 api manager, open banking am +1 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationCVE-2024-58486.1 Medium