WSO2

Latest CVEs · RSS

• CVE-2024-8122 2026-10-08 · CVSS 5.9
  The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused
• CVE-2025-13166 2026-09-15 · CVSS 3.7
  The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses recei
• CVE-2025-5802 2026-09-15 · CVSS 5.3
  The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to
• CVE-2026-19515 2026-09-15 · CVSS 7.0
  The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrus
• CVE-2026-4103 2026-09-14 · CVSS 6.4
  Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization
• CVE-2026-3096 2026-09-10 · CVSS 4.7
  The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly
• CVE-2025-12737 2026-09-03 · CVSS 8.4
  The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with ad
• CVE-2026-3416 2026-09-03 · CVSS 5.9
  The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This
• CVE-2026-3418 2026-08-06 · CVSS 9.1
  The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to
• CVE-2026-3415 2026-08-06 · CVSS 8.7
  The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the X
• CVE-2025-14561 2026-08-06 · CVSS 9.0
  In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privile
• CVE-2025-12317 2026-08-06 · CVSS 5.0
  When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with
• CVE-2025-6508 2026-08-06 · CVSS 4.3
  The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API de
• CVE-2024-6541 2026-08-06 · CVSS 6.8
  The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated
• CVE-2026-5430 2026-08-06 · CVSS 10.0
  The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a J
• CVE-2026-1728 2026-08-06 · CVSS 9.8
  Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this
• CVE-2025-15039 2026-08-06 · CVSS 9.4
  The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific m
• CVE-2026-0637 2026-08-06 · CVSS 4.4
  When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without suffici
• CVE-2025-13394 2026-08-06 · CVSS 5.4
  The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically,
• CVE-2025-13909 2026-08-06 · CVSS 4.3
  The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-facto
• CVE-2025-12627 2026-08-06 · CVSS 2.4
  The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who h
• CVE-2025-14779 2026-08-06 · CVSS 3.8
  The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails t
• CVE-2025-11850 2026-08-06 · CVSS 4.3
  When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user s
• CVE-2025-13736 2026-08-06 · CVSS 3.7
  When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and d
• CVE-2024-10302 2026-08-06 · CVSS 4.0
  The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be incl