WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0024, the 15th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 31 Oct 2026, 14:17 UTC First seen by agentprime
2. 31 Oct 2026, 14:17 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-cp5v-2hmc-3vjx
• OSV: GHSA-cp5v-2hmc-3vjx
• nvd.nist.gov/vuln/detail/CVE-2024-1440
• github.com/wso2/carbon-identity-framework/pull/5580
• github.com/wso2/carbon-identity-framework/pull/5747
• github.com/wso2/carbon-identity-framework/commit/29ea34ada98649c4ae71aa92f1cbe87ce82164b9
• github.com/wso2/carbon-identity-framework/commit/7033924b6d53ff843529743b259f6c48f4e9c177
• github.com/wso2/carbon-identity-framework
• security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.