# WSO2 Identity Server as Key Manager. Every CVE that names WSO2 Identity Server as Key Manager among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers](https://agentprime.io/advisories/CVE-2025-1397.md) `CVE-2025-1397` · CVE record: WSO2 WSO2 Universal Gateway and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control - [Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks](https://agentprime.io/advisories/CVE-2024-12139.md) `CVE-2024-12139` · CVE record: WSO2 WSO2 API Manager and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-116 - [Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts](https://agentprime.io/advisories/CVE-2024-9517.md) `CVE-2024-9517` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass - [Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks](https://agentprime.io/advisories/CVE-2024-2372.md) `CVE-2024-2372` · CVE record: WSO2 WSO2 Open Banking AM and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Open redirect - [Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data](https://agentprime.io/advisories/CVE-2026-18800.md) `CVE-2026-18800` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths](https://agentprime.io/advisories/CVE-2025-13647.md) `CVE-2025-13647` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure - [Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions](https://agentprime.io/advisories/CVE-2025-11969.md) `CVE-2025-11969` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control - [Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products \[Disrupted Authentication Flows\]](https://agentprime.io/advisories/CVE-2026-3583.md) `CVE-2026-3583` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 3.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass - [Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources](https://agentprime.io/advisories/CVE-2025-14260.md) `CVE-2025-14260` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 8.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage](https://agentprime.io/advisories/CVE-2024-6423.md) `CVE-2024-6423` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-20 - [Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-7478.md) `CVE-2024-7478` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-204 - [Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection](https://agentprime.io/advisories/CVE-2024-5139.md) `CVE-2024-5139` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-2323.md) `CVE-2024-2323` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass - [Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations](https://agentprime.io/advisories/CVE-2024-4412.md) `CVE-2024-4412` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 2.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection - [Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination](https://agentprime.io/advisories/CVE-2025-13173.md) `CVE-2025-13173` · CVE record: WSO2 WSO2 API Control Plane and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass - [Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover](https://agentprime.io/advisories/CVE-2025-10149.md) `CVE-2025-10149` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, CWE-281 - [Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2024-4457.md) `CVE-2024-4457` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Command injection - [Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2025-5802.md) `CVE-2025-5802` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2025-12737.md) `CVE-2025-12737` · CVE record: WSO2 WSO2 Open Banking AM and 4 more · CVSS 8.4 High · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection - [Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-15039.md) `CVE-2025-15039` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693 - [Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions](https://agentprime.io/advisories/CVE-2025-13394.md) `CVE-2025-13394` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site request forgery (CSRF) - [Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2025-13736.md) `CVE-2025-13736` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 3.7 Low · Not analysed yet · Published 6 Aug 2026 · Tags: Information disclosure - [Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure](https://agentprime.io/advisories/CVE-2024-10302.md) `CVE-2024-10302` · CVE record: WSO2 WSO2 API Control Plane and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-20 - [Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks](https://agentprime.io/advisories/CVE-2024-6832.md) `CVE-2024-6832` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693 - [Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access](https://agentprime.io/advisories/CVE-2024-8995.md) `CVE-2024-8995` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Authentication bypass - [Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification](https://agentprime.io/advisories/CVE-2025-8591.md) `CVE-2025-8591` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site scripting (XSS) - [Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation](https://agentprime.io/advisories/CVE-2024-1248.md) `CVE-2024-1248` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: CWE-298 - [Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-0391.md) `CVE-2024-0391` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-204 - [XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service](https://agentprime.io/advisories/CVE-2024-2374.md) `CVE-2024-2374` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: XML external entities (XXE) - [Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-9312.md) `CVE-2025-9312` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: Authentication bypass - [Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services](https://agentprime.io/advisories/CVE-2025-6670.md) `CVE-2025-6670` · CVE record: WSO2 WSO2 Open Banking AM and 4 more · CVSS 8.8 High · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site request forgery (CSRF) - [Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding](https://agentprime.io/advisories/CVE-2025-10853.md) `CVE-2025-10853` · CVE record: WSO2 WSO2 Open Banking IAM and 4 more · CVSS 5.2 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: Cross-site scripting (XSS) - [Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)](https://agentprime.io/advisories/CVE-2025-11093.md) `CVE-2025-11093` · CVE record: WSO2 WSO2 Micro Integrator and 4 more · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2025 · Tags: Code injection - [Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-10907.md) `CVE-2025-10907` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2025 · Tags: Unrestricted file upload - [Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-3125.md) `CVE-2025-3125` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: Unrestricted file upload - [Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure](https://agentprime.io/advisories/CVE-2025-5605.md) `CVE-2025-5605` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Authentication bypass - [SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-5350.md) `CVE-2025-5350` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF) - [Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs](https://agentprime.io/advisories/CVE-2025-9804.md) `CVE-2025-9804` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: Broken access control - [Potential Broken Access Control in Multiple WSO2 Products via System REST APIs](https://agentprime.io/advisories/CVE-2025-10611.md) `CVE-2025-10611` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: Broken access control - [Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-1862.md) `CVE-2025-1862` · CVE record: WSO2 WSO2 Enterprise Integrator and 3 more · CVSS 6.7 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Unrestricted file upload - [Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association](https://agentprime.io/advisories/CVE-2025-0672.md) `CVE-2025-0672` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 2 more · CVSS 3.3 Low · Not analysed yet · Published 23 Sept 2025 · Tags: Authentication bypass - [Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login](https://agentprime.io/advisories/CVE-2025-0663.md) `CVE-2025-0663` · CVE record: WSO2 WSO2 Open Banking IAM and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Authentication bypass - [Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files](https://agentprime.io/advisories/CVE-2024-3511.md) `CVE-2024-3511` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Jun 2025 · Tags: Broken access control - [Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor](https://agentprime.io/advisories/CVE-2024-3509.md) `CVE-2024-3509` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Cross-site scripting (XSS) - [Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services](https://agentprime.io/advisories/CVE-2024-7073.md) `CVE-2024-7073` · CVE record: WSO2 WSO2 Identity Server as Key Manager and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Server-side request forgery (SSRF) - [Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup](https://agentprime.io/advisories/CVE-2024-7097.md) `CVE-2024-7097` · CVE record: WSO2 WSO2 Open Banking AM and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 May 2025 · Tags: Broken access control - [Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover](https://agentprime.io/advisories/CVE-2024-6914.md) `CVE-2024-6914` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2025 · Tags: Broken access control ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .