WSO2 vulnerabilities
131 CVEs and advisories name WSO2 as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- CVE-2024-8995Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
- CVE-2026-2445Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
- CVE-2026-4249Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
- CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
- CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
- CVE-2025-13475Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
- CVE-2026-2053Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
- CVE-2025-10470Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
- CVE-2025-9973Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
- CVE-2025-8325Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
- CVE-2025-8154HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
- CVE-2025-10908Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
- CVE-2024-0391Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
- CVE-2025-10503Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
- CVE-2025-12624Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
- CVE-2025-6024Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
- CVE-2024-10242Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection
- CVE-2024-8010XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
- CVE-2024-4867Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval
- CVE-2024-2374XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
- CVE-2024-1524A local user can be impersonated when using federated authentication with Silent JIT Provisioning.
- CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission.
- CVE-2025-12107Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2025-9312Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- CVE-2025-6670Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- CVE-2025-10853Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
- CVE-2025-5770Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
- CVE-2025-11093Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- CVE-2025-10907Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution