WSO2 vulnerabilities
131 CVEs and advisories name WSO2 as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-10149Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- CVE-2025-7203Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
- CVE-2025-7043Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
- CVE-2025-6623Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
- CVE-2024-4457Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- CVE-2024-8122Potential brute force vulnerability due to non-expiring SMS OTPs
- CVE-2025-13166Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery
- CVE-2025-5802Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
- CVE-2026-19515OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
- CVE-2026-4103Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
- CVE-2026-3096Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
- CVE-2025-12737Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2026-3416Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
- CVE-2026-3418Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2026-3415XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
- CVE-2025-14561Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
- CVE-2025-12317Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
- CVE-2025-6508User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests
- CVE-2024-6541Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
- CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
- CVE-2026-1728Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
- CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- CVE-2026-0637Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
- CVE-2025-13394Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
- CVE-2025-13909Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
- CVE-2025-12627Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
- CVE-2025-14779Improper Access Control via Secret Type Management API in WSO2 Identity Server
- CVE-2025-11850Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
- CVE-2025-13736Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
- CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure