CVE-2025-14260

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

Published Oct 28, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Description

Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.1.0
`3.1.0`	affected	< 3.1.0.354
`3.2.0`	affected	< 3.2.0.458
`3.2.1`	affected	< 3.2.1.99
`4.0.0`	affected	< 4.0.0.379
`4.1.0`	affected	< 4.1.0.265
`4.2.0`	affected	< 4.2.0.205
`4.3.0`	affected	< 4.3.0.115
`4.4.0`	affected	< 4.4.0.79

WSO2

WSO2 Identity Server as Key Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.374

WSO2

WSO2 Open Banking AM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.403

WSO2

WSO2 Open Banking IAM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.423

WSO2

WSO2 Identity Server

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.383
`5.11.0`	affected	< 5.11.0.430
`6.0.0`	affected	< 6.0.0.256
`6.1.0`	affected	< 6.1.0.257
`7.0.0`	affected	< 7.0.0.134

WSO2

SAML2 SSO Authenticator UI Bundle

unknown

Version	Status	Constraints
`5.5.0`	affected	< 5.5.0.2
`5.5.2`	affected	< 5.5.2.5
`5.5.9`	affected	< 5.5.9.4
`5.5.10`	affected	< 5.5.10.1
`5.6.4`	affected	< 5.6.4.1
`5.7.2`	affected	< 5.7.2.1
`5.8.3`	affected	< 5.8.3.1
`5.8.7`	affected	< 5.8.7.2
`5.9.4`	affected	< 5.9.4.2
`5.9.9`	unaffected	≤ *

WSO2

WSO2 Carbon UI

unknown

Version	Status	Constraints
`4.6.0`	affected	< 4.6.0.2300
`4.6.1`	affected	< 4.6.1.165
`4.6.3`	affected	< 4.6.3.46
`4.6.4`	affected	< 4.6.4.28
`4.7.1`	affected	< 4.7.1.79
`4.8.1`	affected	< 4.8.1.50
`4.9.0`	affected	< 4.9.0.107
`4.9.26`	affected	< 4.9.26.37
`4.9.27`	affected	< 4.9.27.24
`4.10.9`	affected	< 4.10.9.77
`4.10.42`	unaffected	≤ *

No data.

Vendor Product Versions

Wso2

Api Manager

Version	Status	Scheme	Platform
`[3.1.0,3.1.0.354)`	affected	generic	—
`[3.2.0,3.2.0.458)`	affected	generic	—
`[3.2.1,3.2.1.99)`	affected	generic	—
`[4.0.0,4.0.0.379)`	affected	generic	—
`[4.1.0,4.1.0.265)`	affected	generic	—
`[4.2.0,4.2.0.205)`	affected	generic	—
`[4.3.0,4.3.0.115)`	affected	generic	—
`[4.4.0,4.4.0.79)`	affected	generic	—

Wso2

Identity Server

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.383)`	affected	generic	—
`[5.11.0,5.11.0.430)`	affected	generic	—
`[6.0.0,6.0.0.256)`	affected	generic	—
`[6.1.0,6.1.0.257)`	affected	generic	—
`[7.0.0,7.0.0.134)`	affected	generic	—

Wso2

Saml2 Sso Authenticator Ui Bundle

Version	Status	Scheme	Platform
`[5.5.0,5.5.0.2)`	affected	generic	—
`[5.5.2,5.5.2.5)`	affected	generic	—
`[5.5.9,5.5.9.4)`	affected	generic	—
`[5.5.10,5.5.10.1)`	affected	generic	—
`[5.6.4,5.6.4.1)`	affected	generic	—
`[5.7.2,5.7.2.1)`	affected	generic	—
`[5.8.3,5.8.3.1)`	affected	generic	—
`[5.8.7,5.8.7.2)`	affected	generic	—
`[5.9.4,5.9.4.2)`	affected	generic	—
`[5.9.9,*]`	unaffected	generic	—

Wso2

Wso2 Api Manager

Version	Status	Scheme	Platform
`[3.1.0,3.1.0.354)`	affected	generic	—
`[3.2.0,3.2.0.458)`	affected	generic	—
`[3.2.1,3.2.1.99)`	affected	generic	—
`[4.0.0,4.0.0.379)`	affected	generic	—
`[4.1.0,4.1.0.265)`	affected	generic	—
`[4.2.0,4.2.0.205)`	affected	generic	—
`[4.3.0,4.3.0.115)`	affected	generic	—
`[4.4.0,4.4.0.79)`	affected	generic	—

Wso2

Wso2 Carbon Task Ui

Version	Status	Scheme	Platform
`[4.6.0,4.6.0.2300)`	affected	generic	—
`[4.6.1,4.6.1.165)`	affected	generic	—
`[4.6.3,4.6.3.46)`	affected	generic	—
`[4.6.4,4.6.4.28)`	affected	generic	—
`[4.7.1,4.7.1.79)`	affected	generic	—
`[4.8.1,4.8.1.50)`	affected	generic	—
`[4.9.0,4.9.0.107)`	affected	generic	—
`[4.9.26,4.9.26.37)`	affected	generic	—
`[4.9.27,4.9.27.24)`	affected	generic	—
`[4.10.9,4.10.9.77)`	affected	generic	—
`[4.10.42,*]`	unaffected	generic	—

Wso2

Wso2 Identity Server

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.383)`	affected	generic	—
`[5.11.0,5.11.0.430)`	affected	generic	—
`[6.0.0,6.0.0.256)`	affected	generic	—
`[6.1.0,6.1.0.257)`	affected	generic	—
`[7.0.0,7.0.0.134)`	affected	generic	—

Wso2

Wso2 Identity Server As Key Manager

Version	Status	Scheme	Platform
`[5.10.0,5.10.0.374)`	affected	generic	—

Wso2

Wso2 Open Banking Am

Version	Status	Scheme	Platform
`[2.0.0,2.0.0.403)`	affected	generic	—

Wso2

Wso2 Open Banking Iam

Version	Status	Scheme	Platform
`[2.0.0,2.0.0.423)`	affected	generic	—

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.280% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/

History

Nov 3, 2026 11:15 AM Description updated View changes

Type	Values Removed	Values Added
Description	Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.	Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.

Oct 29, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 28, 2026 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wso2 api Manager Wso2 identity Server Wso2 wso2 Carbon Task Ui
Vendors & Products		Wso2 api Manager Wso2 identity Server Wso2 wso2 Carbon Task Ui

Oct 28, 2026 7:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
Title		Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
First Time appeared		Wso2 Wso2 saml2 Sso Authenticator Ui Bundle Wso2 wso2 Api Manager Wso2 wso2 Carbon Ui Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
Weaknesses		CWE-918
CPEs		cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carbon_ui:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:::::::: cpe:2.3:a:wso2:wso2_open_banking_am:::::::: cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
Vendors & Products		Wso2 Wso2 saml2 Sso Authenticator Ui Bundle Wso2 wso2 Api Manager Wso2 wso2 Carbon Ui Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

Subscriptions

Wso2 Api Manager Identity Server Saml2 Sso Authenticator Ui Bundle Wso2 Api Manager Wso2 Carbon Task Ui Wso2 Carbon Ui Wso2 Identity Server Wso2 Identity Server As Key Manager Wso2 Open Banking Am Wso2 Open Banking Iam

Weaknesses