WSO2 products incorrectly build redirection URLs from user‑supplied input without validating the target domain. This flaw allows an actor to supply a crafted URL that redirects a victim to an arbitrary external site. The resulting redirect can be leveraged in social engineering or phishing campaigns to trick users into submitting credentials or other sensitive data on a malicious page.

The vulnerability affects WSO2 API Manager, WSO2 Carbon Registry Kernel, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. Version information is not provided in the advisory, so all current releases may be impacted.

With a CVSS score of 5.4 the risk level is moderate. The EPSS score is not reported, so the likelihood of exploitation cannot be quantified, but open redirection flaws are common vectors for phishing. The flaw is not listed in the CISA KEV catalog, indicating no known publicly reported exploitation at the time of the advisory. Attackers would need a victim to click a malicious link, after which the redirect leads to an attacker‑controlled domain.