Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint

Summary

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.

Timeline

1. Jun 2, 2025, 4:51 PM UTCCVE published
2. Jun 2, 2025, 5:06 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 2, 2025, 5:07 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 Identity Server

  From 5.10.0 · fixed in 5.10.0.278; From 5.11.0 · fixed in 5.11.0.347; From 6.0.0 · fixed in 6.0.0.185; From 6.1.0 · fixed in 6.1.0.145; From 7.0.0 · fixed in 7.0.0.30

• WSO2 WSO2 API Manager

  From 3.1.0 · fixed in 3.1.0.262; From 3.2.0 · fixed in 3.2.0.344; From 4.0.0 · fixed in 4.0.0.296

• WSO2 WSO2 Identity Server as Key Manager

  From 5.10.0 · fixed in 5.10.0.298

• WSO2 WSO2 Open Banking AM

  From 2.0.0 · fixed in 2.0.0.308

• WSO2 WSO2 Open Banking IAM

  From 2.0.0 · fixed in 2.0.0.327

• org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util

  From 5.17.5 · fixed in 5.17.5.256; From 5.18.187 · fixed in 5.18.187.257; From 5.23.8 · fixed in 5.23.8.174; From 5.25.92 · fixed in 5.25.92.77; From 7.0.78 · fixed in 7.0.78.18

• org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.utilMaven

  From 6.0.0 · fixed in 7.0.111

• org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.utilMaven

  fixed in 5.25.707

References 1