WSO2 API Manager's message flow component does not validate user‑controlled input in WS‑Addressing headers, allowing an attacker to tamper with these headers and direct server‑initiated requests to arbitrary destinations. Because the platform lacks proper input validation for these headers, a malicious actor can forge requests to communicate with internal services that are otherwise inaccessible from the public network. Successful exploitation thus results in unauthorized internal network access rather than direct code execution on the API Manager host.

All releases of WSO2 API Manager are potentially affected. The advisory does not specify a concrete version range, so any instance of the product should be examined for the presence of the flaw.

The CVSS score of 8.3 indicates high severity, and while an EPSS score is not available, the known lack of authentication requirement points to a readily exploitable vector over the public network. An attacker does not need credentials and can send a crafted SOAP message containing forged WS‑Addressing headers to the API Manager, causing it to reach out to a target of the attacker's choice. Because the vulnerability is not mitigated by the internal network perimeter, compromised internal services are at risk. The advisory does not list this issue in the CISA KEV catalog, but the high CVSS and easy exploitation warrant priority patching.