WSO2 Identity Server.

Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

• WSO2 Identity Server
• WSO2 Identity Application Management Component
• Privilege escalation

Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

• WSO2 API Control Plane
• WSO2 API Manager
• Cross-site scripting (XSS)

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Broken access control

Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-116

Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

• WSO2 Identity Server
• Open redirect

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

• WSO2 API Manager
• WSO2 Universal Gateway
• Authentication bypass

Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

• WSO2 Open Banking AM
• WSO2 API Manager
• Open redirect

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

• WSO2 API Manager
• WSO2 Traffic Manager
• Information disclosure

Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths

• WSO2 Identity Server
• WSO2 Open Banking IAM
• Information disclosure

Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Cross-site scripting (XSS)

Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-799

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

• WSO2 Identity Server
• WSO2 Carbon OAuth
• Authentication bypass

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 API Control Plane
• Cross-site scripting (XSS)

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• Server-side request forgery (SSRF)

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

• WSO2 API Manager
• WSO2 Open Banking AM
• CWE-20

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

• WSO2 Identity Server
• WSO2 Carbon OAuth
• Authentication bypass

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• CWE-204

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

• WSO2 Identity Server
• Authentication bypass

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

• WSO2 Enterprise Integrator
• WSO2 Identity Server
• Cross-site scripting (XSS)

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Enterprise Integrator
• WSO2 Identity Server
• Authentication bypass

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Code injection

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

• WSO2 API Control Plane
• WSO2 Universal Gateway
• Authentication bypass

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

• WSO2 Identity Server
• WSO2 Carbon Abstract OTP Authenticator
• Information disclosure

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

• WSO2 Identity Server as Key Manager
• WSO2 Open Banking IAM
• Information disclosure
• CWE-281

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Information disclosure

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Command injection

Potential brute force vulnerability due to non-expiring SMS OTPs

• WSO2 Identity Server
• Authentication bypass

Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

• WSO2 Identity Server
• Information disclosure

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 API Control Plane
• Information disclosure

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Command injection

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

• WSO2 Enterprise Integrator
• WSO2 Identity Server
• Authentication bypass

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

• WSO2 Identity Server
• WSO2 API Manager
• CWE-693

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site request forgery (CSRF)

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

• WSO2 Identity Server
• WSO2 Carbon Identity Application Authentication Framework
• Information disclosure
• CWE-20

Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

• WSO2 Identity Server
• WSO2 Carbon OAuth
• Authentication bypass

Improper Access Control via Secret Type Management API in WSO2 Identity Server

• WSO2 Identity Server
• WSO2 Carbon Identity API Server Secret Management Common
• CWE-281

Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

• WSO2 Identity Server
• WSO2 Token Exchange Grant Type For OAuth
• Broken access control

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Identity Server as Key Manager
• WSO2 Identity Server
• Information disclosure

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

• WSO2 API Control Plane
• WSO2 Traffic Manager
• CWE-20

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 Enterprise Integrator
• WSO2 API Control Plane
• CWE-693

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

• WSO2 API Manager
• WSO2 API Control Plane
• Cross-site scripting (XSS)

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site scripting (XSS)

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

• WSO2 API Manager
• WSO2 Identity Server
• CWE-298

Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure

• WSO2 Identity Server
• WSO2 API Manager
• Authentication bypass

Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

• WSO2 Identity Server
• WSO2 Carbon MagicLink Authenticator Module
• Denial of service

Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

• WSO2 Identity Server
• WSO2 Conditional Authentication User and Roles Related Functions
• Broken access control

Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

• WSO2 Identity Server
• WSO2 Carbon MagicLink Authenticator Module
• Broken access control

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Identity Server
• WSO2 Open Banking IAM
• CWE-204

Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

• WSO2 Identity Server
• Cross-site scripting (XSS)

Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock

• WSO2 Identity Server
• Authentication bypass

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

• WSO2 API Manager
• WSO2 Identity Server
• Cross-site scripting (XSS)

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

• WSO2 API Manager
• WSO2 Identity Server
• XML external entities (XXE)

A local user can be impersonated when using federated authentication with Silent JIT Provisioning.

• WSO2 API Manager
• WSO2 Identity Server
• Authentication bypass

Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 Identity Server
• Command injection
• Code injection

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 API Control Plane
• Authentication bypass

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Cross-site request forgery (CSRF)

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

• WSO2 Open Banking IAM
• WSO2 API Manager
• Cross-site scripting (XSS)

Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site scripting (XSS)