Unrestricted access to the server’s outbound request mechanism is enabled by a missing validation of the requested resource location. As a result, an attacker can supply arbitrary URLs or file paths and trick the WSO2 application into fetching data from internal or external resources. This uses the server’s network privileges to retrieve information that should otherwise be protected, enabling data exfiltration or discovery of internal services.

WSO2 SAML2 SSO Authenticator UI Bundle, WSO2 API Manager, WSO2 Carbon UI, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. No specific version numbers were disclosed in the advisory, so all existing releases of these components could potentially be affected until the patch is applied.

The vulnerability scores a CVSS of 8.3, indicating a high‑severity risk with high confidentiality impact and no authentication required. EPSS data is not available, but the absence of authentication and the straightforward request manipulation suggest the exploit probability is substantial. Because the vulnerability is not listed in CISA’s KEV catalog, no public exploitation reports are yet recorded, yet the attack surface and the possibility of internal reconnaissance make it a serious threat. An attacker can craft a payload that causes the server to load data from arbitrary URLs or internal network addresses, effectively turning the application into a proxy for illicit data retrieval. No additional prerequisites are listed, implying that the exploit can be performed from any network location that can reach the vulnerable service.