CVE-2025-6623

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Wso2 Api Control Plane and 5 more

CVE-2025-7203

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 8 more

CVE-2026-0637

Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery

When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs. An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 14 more

CVE-2025-1397

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 10 more

CVE-2025-11969

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Wso2 Api Control Plane and 8 more

CVE-2026-2613

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Wso2 Api Control Plane and 4 more

CVE-2026-18800

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 9 more

CVE-2024-9517

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 9 more

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 9 more

CVE-2025-7043

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Forgerock Key Manager Component Wso2 Api Control Plane Wso2 Api Manager and 1 more

CVE-2025-13173

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination. This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Api Control Plane Wso2 Api Manager and 7 more

CVE-2024-8008

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Manager Enterprise Integrator Identity Server and 13 more

CVE-2026-5430

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

CVSS 3.1 · 10 Critical EPSS 22.4% KEV · Listed

Vendors

Wso2

Products

Api Control Plane Api Manager Traffic Manager and 6 more

CVE-2025-12737

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 13 more

CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Enterprise Integrator and 53 more

CVE-2025-15039

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Carbon Identity Application Authentication Framework and 17 more

CVE-2025-14561

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Management Implementation and 3 more

CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Gateway and 3 more

CVE-2026-3418

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Carbon Api Management Api and 9 more

CVE-2024-6832

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Identity Server and 15 more