WSO2 WSO2 Identity Server

• CVE-2025-11229 High 7.2 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server 0.4%
• CVE-2025-5769 Medium 6.1 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification 0.2%
• CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
• CVE-2024-12139 Medium 4.3 Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks 0.2%
• CVE-2024-12141 Medium 4.3 Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks 0.2%
• CVE-2024-9517 Medium 4.9 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 0.2%
• CVE-2024-2372 Medium 5.4 Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks 0.2%
• CVE-2026-18800 Medium 4.4 Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data 0.2%
• CVE-2025-13647 Medium 5.8 Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths 0.2%
• CVE-2024-7075 Medium 4.6 Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products 0.2%
• CVE-2024-5617 Medium 4.8 Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks 0.2%
• CVE-2026-6647 High 7.4 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events 0.2%
• CVE-2026-3583 Low 3.1 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] 0.3%
• CVE-2026-11854 Medium 6.1 Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products 0.2%
• CVE-2025-14260 High 8.3 Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources 0.3%
• CVE-2024-6423 Medium 4.0 Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage 0.1%
• CVE-2025-0326 High 7.4 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access 0.3%
• CVE-2024-7478 Medium 5.8 Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery 0.2%
• CVE-2024-5563 Medium 4.8 Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks 0.2%
• CVE-2024-5139 Medium 6.1 Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection 0.2%
• CVE-2024-2323 Medium 4.8 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery 0.2%
• CVE-2024-4412 Low 2.7 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations 0.4%
• CVE-2025-13173 Medium 6.5 Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination 0.2%
• CVE-2025-13591 Medium 5.3 Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery 0.3%
• CVE-2025-10149 High 8.2 Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover 0.2%
• CVE-2025-7203 Medium 4.9 Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials 0.2%
• CVE-2024-4457 Critical 9.1 Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution 0.4%
• CVE-2024-8122 Medium 5.9 Potential brute force vulnerability due to non-expiring SMS OTPs 0.3%
• CVE-2025-13166 Low 3.7 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery 0.3%
• CVE-2025-5802 Medium 5.3 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery 0.3%
• CVE-2025-12737 High 8.4 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution 0.4%
• CVE-2025-12317 Medium 5.0 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges 0.3%
• CVE-2025-15039 Critical 9.4 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products 0.7%
• CVE-2025-13394 Medium 5.4 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions 0.1%
• CVE-2025-13909 Medium 4.3 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure 0.3%
• CVE-2025-12627 Low 2.4 Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions 0.2%
• CVE-2025-14779 Low 3.8 Improper Access Control via Secret Type Management API in WSO2 Identity Server 0.3%
• CVE-2025-11850 Medium 4.3 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use] 0.3%
• CVE-2025-13736 Low 3.7 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery 0.3%
• CVE-2024-10302 Medium 4.0 Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure 0.3%
• CVE-2024-6832 Medium 5.9 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks 0.4%
• CVE-2024-8995 Medium 4.9 Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access 0.2%
• CVE-2026-2445 Medium 6.1 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification 0.3%
• CVE-2025-8591 Medium 6.1 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification 0.3%
• CVE-2024-1248 Medium 4.8 Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation 0.3%
• CVE-2025-13475 Low 3.5 Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure 0.3%
• CVE-2025-10470 High 8.6 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability 0.3%
• CVE-2025-9973 Medium 6.4 Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover 0.4%
• CVE-2025-10908 High 7.3 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access 0.2%
• CVE-2024-0391 Medium 5.3 Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery 0.2%