Wso2 Api Manager
Monthly
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile).
Cached OAuth2 introspection responses in WSO2 API Manager, WSO2 Identity Server and related WSO2 identity/gateway products can cause a revoked access token to be returned to the client again until the cache entry is cleared, but only when the allowed_scopes configuration is enabled. An authenticated OAuth2 client able to call both the introspection and revocation endpoints must also hit a narrow ordering window - introspecting a token immediately before revoking it - which is why the issue is rated low (CVSS 3.1, AV:N/AC:H/PR:L, C:N/I:N/A:L). The re-issued token is not accepted for API authorization, so there is no confidentiality or integrity loss; the practical effect is a limited availability/authentication-flow disruption, since affected users may be unable to obtain a new valid token until the cache is flushed. No public exploit code and no active exploitation have been identified at time of analysis, and the priority decision is monitor.
Reflected cross-site scripting (CWE-79) affects WSO2's authentication endpoint, which echoes unsanitized request data into error messages; per the vendor advisory, default configurations of WSO2 API Manager, WSO2 API Control Plane, and WSO2 Identity Server are impacted. An unauthenticated remote attacker must convince a victim to follow a crafted link (UI:R), after which injected script runs in the WSO2 origin and can redirect the user, alter the page interface, or read script-accessible information. Because session-related cookies carry the httpOnly flag, the vendor explicitly notes that session hijacking and cookie theft are not possible, keeping this at medium severity (CVSS 6.1); no public exploit or active exploitation is identified at time of analysis.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound tokens valid after the user session ends when token binding validation is enabled and the 'Revoke token upon user logout' option is inactive. An attacker who already possesses such a token can retain access to protected applications and data after logout; this is a moderate, conditionally exploitable session-management flaw that requires a non-default configuration and prior token acquisition, and no public exploit code or active exploitation is identified at time of analysis.
Cleartext storage of remote log server credentials, truststore passwords, and keystore passwords in WSO2 API Manager and related WSO2 products lets high-privileged authenticated Management Console users or anyone with direct read access to product files recover secrets when remote logging is enabled. The flaw is medium severity (CVSS 4.9, CWE-312) and limited to confidentiality; it can enable manipulation of log entries and compromise of the remote log server after credentials are obtained. No public exploit was identified at time of analysis, and deployments without remote logging enabled are not exposed through this path.
Refresh-token validation failure in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane allows a remote attacker who possesses a valid refresh token to present it as an access token and reach protected resources without completing the required client-credential exchange. The CVSS 3.1 score is 5.4 with AC:H because exploitation is gated by prior acquisition of a refresh token; no public exploit code and no CISA KEV entry are identified in the provided data.
Stored cross-site scripting in the WSO2 Carbon management console lets a high-privileged authenticated console user plant malicious JavaScript in event publisher or receiver property values, which executes when another console user opens the affected details page. The flaw requires adjacent-network access, high privileges, and victim interaction and is rated CVSS 4.3, with session hijacking prevented by httpOnly cookies. No public exploit identified at time of analysis and a vendor patch is available; the combined constraints make this a low real-world priority.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-tenant consent leakage in WSO2 Identity Server and WSO2 API Manager multi-tenant deployments lets a SaaS application in one tenant inherit OAuth/OpenID consent that a user granted to a same-named application in a different tenant, breaking tenant isolation of authorization scopes. Because matching is done by application name rather than a tenant-scoped identifier, an application in attacker-controlled tenant B can read and modify a victim's data in tenant A without that user's explicit authorization. No active exploitation is reported (not in CISA KEV, EPSS 0.15%/4th percentile) and no public exploit is identified, but a vendor patch is available.
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The component accepts XML input through the publisher without disabling external entity resolution. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile).
Cached OAuth2 introspection responses in WSO2 API Manager, WSO2 Identity Server and related WSO2 identity/gateway products can cause a revoked access token to be returned to the client again until the cache entry is cleared, but only when the allowed_scopes configuration is enabled. An authenticated OAuth2 client able to call both the introspection and revocation endpoints must also hit a narrow ordering window - introspecting a token immediately before revoking it - which is why the issue is rated low (CVSS 3.1, AV:N/AC:H/PR:L, C:N/I:N/A:L). The re-issued token is not accepted for API authorization, so there is no confidentiality or integrity loss; the practical effect is a limited availability/authentication-flow disruption, since affected users may be unable to obtain a new valid token until the cache is flushed. No public exploit code and no active exploitation have been identified at time of analysis, and the priority decision is monitor.
Reflected cross-site scripting (CWE-79) affects WSO2's authentication endpoint, which echoes unsanitized request data into error messages; per the vendor advisory, default configurations of WSO2 API Manager, WSO2 API Control Plane, and WSO2 Identity Server are impacted. An unauthenticated remote attacker must convince a victim to follow a crafted link (UI:R), after which injected script runs in the WSO2 origin and can redirect the user, alter the page interface, or read script-accessible information. Because session-related cookies carry the httpOnly flag, the vendor explicitly notes that session hijacking and cookie theft are not possible, keeping this at medium severity (CVSS 6.1); no public exploit or active exploitation is identified at time of analysis.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound tokens valid after the user session ends when token binding validation is enabled and the 'Revoke token upon user logout' option is inactive. An attacker who already possesses such a token can retain access to protected applications and data after logout; this is a moderate, conditionally exploitable session-management flaw that requires a non-default configuration and prior token acquisition, and no public exploit code or active exploitation is identified at time of analysis.
Cleartext storage of remote log server credentials, truststore passwords, and keystore passwords in WSO2 API Manager and related WSO2 products lets high-privileged authenticated Management Console users or anyone with direct read access to product files recover secrets when remote logging is enabled. The flaw is medium severity (CVSS 4.9, CWE-312) and limited to confidentiality; it can enable manipulation of log entries and compromise of the remote log server after credentials are obtained. No public exploit was identified at time of analysis, and deployments without remote logging enabled are not exposed through this path.
Refresh-token validation failure in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane allows a remote attacker who possesses a valid refresh token to present it as an access token and reach protected resources without completing the required client-credential exchange. The CVSS 3.1 score is 5.4 with AC:H because exploitation is gated by prior acquisition of a refresh token; no public exploit code and no CISA KEV entry are identified in the provided data.
Stored cross-site scripting in the WSO2 Carbon management console lets a high-privileged authenticated console user plant malicious JavaScript in event publisher or receiver property values, which executes when another console user opens the affected details page. The flaw requires adjacent-network access, high privileges, and victim interaction and is rated CVSS 4.3, with session hijacking prevented by httpOnly cookies. No public exploit identified at time of analysis and a vendor patch is available; the combined constraints make this a low real-world priority.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-tenant consent leakage in WSO2 Identity Server and WSO2 API Manager multi-tenant deployments lets a SaaS application in one tenant inherit OAuth/OpenID consent that a user granted to a same-named application in a different tenant, breaking tenant isolation of authorization scopes. Because matching is done by application name rather than a tenant-scoped identifier, an application in attacker-controlled tenant B can read and modify a victim's data in tenant A without that user's explicit authorization. No active exploitation is reported (not in CISA KEV, EPSS 0.15%/4th percentile) and no public exploit is identified, but a vendor patch is available.
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The component accepts XML input through the publisher without disabling external entity resolution. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.