WSO2 vulnerabilities
131 CVEs and advisories name WSO2 as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-11229Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
- CVE-2026-4052Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
- CVE-2025-5769Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification
- CVE-2025-1397Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled…
- CVE-2024-12139Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
- CVE-2024-12141Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
- CVE-2024-9517Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
- CVE-2024-2372Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
- CVE-2025-12544Stored Cross-Site Scripting in Multiple WSO2 Products
- CVE-2026-2613SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
- CVE-2026-18800Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
- CVE-2025-13647Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
- CVE-2024-7075Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
- CVE-2024-5617Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
- CVE-2025-11969Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
- CVE-2026-78674Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
- CVE-2026-6647Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
- CVE-2026-3583Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- CVE-2026-11854Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
- CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
- CVE-2024-6423Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
- CVE-2025-0326Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
- CVE-2024-7478Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
- CVE-2024-5563Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
- CVE-2024-4989Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
- CVE-2024-5139Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- CVE-2024-2323Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- CVE-2024-4412Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- CVE-2025-13173Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- CVE-2025-13591Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery