Vulnerability · Published May 22, 2025 · Assigned by WSO2
CVE-2024-7487Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
Medium 5.8
In plain English
A medium-severity improper authentication in Client Attestation Filter from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Identity Server | 7.0.0 – before 7.0.0.65 |
| WSO2 | Client Attestation Filter | 7.0.26 – before 7.0.26.24 |
| WSO2 | WSO2 Carbon Identity Client Attestation Met Data Mgt BE | 7.0.78 – before 7.0.78.44 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N