The vulnerability is caused by the lack of enforcement of validation constraints on the content‑type header when processing certain requests in WSO2 products. An attacker who can send a crafted request with a manipulated content‑type header can trigger the system to unintentionally disclose the file paths of certificate files. This disclosure expands an attacker’s knowledge of the internal file system and can be leveraged for further attacks or compromise system confidentiality.

The affected products are WSO2 Identity Server, WSO2 Identity Server Keystore Rest API Commons, WSO2 Identity Server Keystore Rest API V1, WSO2 Identity Server as Key Manager, and WSO2 Open Banking IAM. Version details are not specified, so all releases of these products that incorporate the vulnerable component may be impacted.

The CVSS score of 5.8 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a network‑based request to the affected API endpoints carrying a crafted content‑type header. The lack of header validation permits the exposure of sensitive file paths, potentially aiding subsequent attacks. If an attacker gains this information, they may use it to identify certificates, configure man‑in‑the‑middle proxies, or target other components that rely on those certificates.