An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.

By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.278
5.11.0 affected < 5.11.0.347
6.0.0 affected < 6.0.0.185
6.1.0 affected < 6.1.0.145
7.0.0 affected < 7.0.0.30
WSO2 WSO2 API Manager unaffected
Version Status Constraints
0 unknown < 3.1.0
3.1.0 affected < 3.1.0.262
3.2.0 affected < 3.2.0.344
4.0.0 affected < 4.0.0.296
WSO2 WSO2 Identity Server as Key Manager unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.298
WSO2 WSO2 Open Banking AM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.308
WSO2 WSO2 Open Banking IAM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.327
WSO2 WSO2 Carbon Identity Application Authentication Endpoint(Utils) unknown
Version Status Constraints
5.17.5 affected < 5.17.5.256
5.18.187 affected < 5.18.187.257
5.23.8 affected < 5.23.8.174
5.25.92 affected < 5.25.92.77
7.0.78 affected < 7.0.78.18
7.0.111 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Wso2 Subscribe
Api Manager Subscribe
Identity Server Subscribe
Identity Server As Key Manager Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2024-17193 An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
Github GHSA Github GHSA GHSA-cp5v-2hmc-3vjx WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint
Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/ cve-icon cve-icon
History

Mon, 06 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Wso2
Wso2 api Manager
Wso2 identity Server
Wso2 identity Server As Key Manager
CPEs cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 api Manager
Wso2 identity Server
Wso2 identity Server As Key Manager

Mon, 02 Jun 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Jun 2025 17:00:00 +0000

Type Values Removed Values Added
Description An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
Title Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
Weaknesses CWE-601
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2025-06-02T17:07:01.605Z

Reserved: 2024-02-12T09:53:51.193Z

Link: CVE-2024-1440

cve-icon Vulnrichment

Updated: 2025-06-02T17:06:54.680Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-02T17:15:21.153

Modified: 2025-10-06T13:48:42.233

Link: CVE-2024-1440

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses