The vulnerability is an input validation flaw (CWE-20) that allows users to supply sensitive information through URL parameters. Although the application does not process the data, it accepts and writes it to access logs, creating a confidential data disclosure risk. This directly threatens the confidentiality of information handled by the affected WSO2 products.

The flaw affects several WSO2 products, including WSO2 API Manager, WSO2 Carbon Identity Application, WSO2 Carbon Identity Core, WSO2 Carbon Identity OAuth, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. No specific product versions are identified in the advisory.

The CVSS score of 4 indicates moderate severity, and the EPSS score is not available, suggesting no current evidence of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the likely attack vector is an attacker crafting a malicious URL that includes sensitive information as query parameters and directing an authorized user or a legitimate application to access that URL; the application accepts the data and records it in access logs. While the product does not process the data, the acceptance and logging create a confidential data disclosure risk. This exposure could compromise confidentiality if logs are accessible to privileged users or external observers. The potential for data leakage elevates the risk, especially when log retention and access controls are weak.