CVE-2024-9517

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 9 more

CVE-2024-12141

Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Identity Server

CVE-2025-0326

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Carbon Oauth Wso2 Identity Server

CVE-2024-7478

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Manager Wso2 Carborn Identity Handler and 4 more

CVE-2024-5563

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Identity Server

CVE-2024-5139

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Manager Wso2 Carbon User Management Ui and 5 more

CVE-2024-4989

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Api Manager

CVE-2024-6423

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Manager Wso2 Carbon Identity Application and 6 more

CVE-2026-11854

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 3 more

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 9 more

CVE-2026-6647

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated. A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Carbon Oauth Wso2 Identity Server

CVE-2026-78674

Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Business Process Server Enterprise Integrator Bps Profile

CVE-2025-7043

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Forgerock Key Manager Component Wso2 Api Control Plane Wso2 Api Manager and 1 more

CVE-2024-4412

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Manager Wso2 Carbon Identity Application Authentication Framework and 9 more

CVE-2025-13173

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Control Plane Wso2 Api Manager and 7 more

CVE-2024-4457

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Api Manager Wso2 Carbon User Manager Kernel Wso2 Enterprise Integrator and 4 more

CVE-2025-5770

Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server

CVE-2024-8008

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Manager Enterprise Integrator Identity Server and 13 more

CVE-2025-10908

Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Carbon Magiclink Authenticator Module Wso2 Identity Server

CVE-2024-8122

Potential brute force vulnerability due to non-expiring SMS OTPs

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP. The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Identity Server