Vulnerability · Published Nov 2, 2026 · Assigned by WSO2
CVE-2024-12141Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
Medium 4.3
In plain English
A medium-severity open redirect in WSO2 Identity Server from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Identity Server | 5.10.05.11.06.0.06.1.07.0.07.1.0 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N