Wso2 Open Banking Am
Monthly
Cached OAuth2 introspection responses in WSO2 API Manager, WSO2 Identity Server and related WSO2 identity/gateway products can cause a revoked access token to be returned to the client again until the cache entry is cleared, but only when the allowed_scopes configuration is enabled. An authenticated OAuth2 client able to call both the introspection and revocation endpoints must also hit a narrow ordering window - introspecting a token immediately before revoking it - which is why the issue is rated low (CVSS 3.1, AV:N/AC:H/PR:L, C:N/I:N/A:L). The re-issued token is not accepted for API authorization, so there is no confidentiality or integrity loss; the practical effect is a limited availability/authentication-flow disruption, since affected users may be unable to obtain a new valid token until the cache is flushed. No public exploit code and no active exploitation have been identified at time of analysis, and the priority decision is monitor.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound tokens valid after the user session ends when token binding validation is enabled and the 'Revoke token upon user logout' option is inactive. An attacker who already possesses such a token can retain access to protected applications and data after logout; this is a moderate, conditionally exploitable session-management flaw that requires a non-default configuration and prior token acquisition, and no public exploit code or active exploitation is identified at time of analysis.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Cached OAuth2 introspection responses in WSO2 API Manager, WSO2 Identity Server and related WSO2 identity/gateway products can cause a revoked access token to be returned to the client again until the cache entry is cleared, but only when the allowed_scopes configuration is enabled. An authenticated OAuth2 client able to call both the introspection and revocation endpoints must also hit a narrow ordering window - introspecting a token immediately before revoking it - which is why the issue is rated low (CVSS 3.1, AV:N/AC:H/PR:L, C:N/I:N/A:L). The re-issued token is not accepted for API authorization, so there is no confidentiality or integrity loss; the practical effect is a limited availability/authentication-flow disruption, since affected users may be unable to obtain a new valid token until the cache is flushed. No public exploit code and no active exploitation have been identified at time of analysis, and the priority decision is monitor.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound tokens valid after the user session ends when token binding validation is enabled and the 'Revoke token upon user logout' option is inactive. An attacker who already possesses such a token can retain access to protected applications and data after logout; this is a moderate, conditionally exploitable session-management flaw that requires a non-default configuration and prior token acquisition, and no public exploit code or active exploitation is identified at time of analysis.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.