agentprime: wso2-identity-server

agentprime: wso2-identity-serverEvery new CVE for wso2-identity-server.https://agentprime.io/CVE-2025-11229: Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Serverhttps://agentprime.io/advisories/CVE-2025-11229/https://agentprime.io/advisories/CVE-2025-11229/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 05:29:57 GMTCVECVE-2025-5769: Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modificationhttps://agentprime.io/advisories/CVE-2025-5769/https://agentprime.io/advisories/CVE-2025-5769/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:11:52 GMTCVECVE-2025-1397: Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providershttps://agentprime.io/advisories/CVE-2025-1397/https://agentprime.io/advisories/CVE-2025-1397/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:07:57 GMTCVECVE-2024-12139: Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attackshttps://agentprime.io/advisories/CVE-2024-12139/https://agentprime.io/advisories/CVE-2024-12139/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:34:20 GMTCVECVE-2024-12141: Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attackshttps://agentprime.io/advisories/CVE-2024-12141/https://agentprime.io/advisories/CVE-2024-12141/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 12:24:55 GMTCVECVE-2024-9517: Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accountshttps://agentprime.io/advisories/CVE-2024-9517/https://agentprime.io/advisories/CVE-2024-9517/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:30:15 GMTCVECVE-2024-2372: Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attackshttps://agentprime.io/advisories/CVE-2024-2372/https://agentprime.io/advisories/CVE-2024-2372/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:00:23 GMTCVECVE-2026-18800: Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Datahttps://agentprime.io/advisories/CVE-2026-18800/https://agentprime.io/advisories/CVE-2026-18800/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:59:26 GMTCVECVE-2025-13647: Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Pathshttps://agentprime.io/advisories/CVE-2025-13647/https://agentprime.io/advisories/CVE-2025-13647/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:20:52 GMTCVECVE-2024-7075: Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2024-7075/https://agentprime.io/advisories/CVE-2024-7075/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:11:32 GMTCVECVE-2024-5617: Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-5617/https://agentprime.io/advisories/CVE-2024-5617/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:57:28 GMTCVECVE-2026-6647: Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Eventshttps://agentprime.io/advisories/CVE-2026-6647/https://agentprime.io/advisories/CVE-2026-6647/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:35 GMTCVECVE-2026-3583: Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]https://agentprime.io/advisories/CVE-2026-3583/https://agentprime.io/advisories/CVE-2026-3583/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:34 GMTCVECVE-2026-11854: Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2026-11854/https://agentprime.io/advisories/CVE-2026-11854/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:33 GMTCVECVE-2025-14260: Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resourceshttps://agentprime.io/advisories/CVE-2025-14260/https://agentprime.io/advisories/CVE-2025-14260/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:32 GMTCVECVE-2024-6423: Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakagehttps://agentprime.io/advisories/CVE-2024-6423/https://agentprime.io/advisories/CVE-2024-6423/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:56:26 GMTCVECVE-2025-0326: Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2025-0326/https://agentprime.io/advisories/CVE-2025-0326/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:50:42 GMTCVECVE-2024-7478: Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-7478/https://agentprime.io/advisories/CVE-2024-7478/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:49:07 GMTCVECVE-2024-5563: Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-5563/https://agentprime.io/advisories/CVE-2024-5563/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:44:40 GMTCVECVE-2024-5139: Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirectionhttps://agentprime.io/advisories/CVE-2024-5139/https://agentprime.io/advisories/CVE-2024-5139/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:36:49 GMTCVECVE-2024-2323: Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-2323/https://agentprime.io/advisories/CVE-2024-2323/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 07:46:37 GMTCVECVE-2024-4412: Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operationshttps://agentprime.io/advisories/CVE-2024-4412/https://agentprime.io/advisories/CVE-2024-4412/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:59:05 GMTCVECVE-2025-13173: Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Terminationhttps://agentprime.io/advisories/CVE-2025-13173/https://agentprime.io/advisories/CVE-2025-13173/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:49:08 GMTCVECVE-2025-13591: Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-13591/https://agentprime.io/advisories/CVE-2025-13591/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:45:59 GMTCVECVE-2025-10149: Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeoverhttps://agentprime.io/advisories/CVE-2025-10149/https://agentprime.io/advisories/CVE-2025-10149/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:40:26 GMTCVECVE-2025-7203: Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentialshttps://agentprime.io/advisories/CVE-2025-7203/https://agentprime.io/advisories/CVE-2025-7203/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:38:01 GMTCVECVE-2024-4457: Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Executionhttps://agentprime.io/advisories/CVE-2024-4457/https://agentprime.io/advisories/CVE-2024-4457/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 18 Oct 2026 18:05:34 GMTCVEcriticalCVE-2024-8122: Potential brute force vulnerability due to non-expiring SMS OTPshttps://agentprime.io/advisories/CVE-2024-8122/https://agentprime.io/advisories/CVE-2024-8122/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 00:09:52 GMTCVECVE-2025-13166: Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-13166/https://agentprime.io/advisories/CVE-2025-13166/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 09:53:54 GMTCVECVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-5802/https://agentprime.io/advisories/CVE-2025-5802/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 09:53:53 GMTCVECVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-12737/https://agentprime.io/advisories/CVE-2025-12737/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 13:02:26 GMTCVECVE-2025-12317: Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privilegeshttps://agentprime.io/advisories/CVE-2025-12317/https://agentprime.io/advisories/CVE-2025-12317/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:05 GMTCVECVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-15039/https://agentprime.io/advisories/CVE-2025-15039/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:23 GMTCVEcriticalCVE-2025-13394: Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actionshttps://agentprime.io/advisories/CVE-2025-13394/https://agentprime.io/advisories/CVE-2025-13394/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:17 GMTCVECVE-2025-13909: Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposurehttps://agentprime.io/advisories/CVE-2025-13909/https://agentprime.io/advisories/CVE-2025-13909/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:14 GMTCVECVE-2025-12627: Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actionshttps://agentprime.io/advisories/CVE-2025-12627/https://agentprime.io/advisories/CVE-2025-12627/CVSS 2.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:12 GMTCVECVE-2025-14779: Improper Access Control via Secret Type Management API in WSO2 Identity Serverhttps://agentprime.io/advisories/CVE-2025-14779/https://agentprime.io/advisories/CVE-2025-14779/CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:10 GMTCVECVE-2025-11850: Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]https://agentprime.io/advisories/CVE-2025-11850/https://agentprime.io/advisories/CVE-2025-11850/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:07 GMTCVECVE-2025-13736: Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-13736/https://agentprime.io/advisories/CVE-2025-13736/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:03 GMTCVECVE-2024-10302: Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposurehttps://agentprime.io/advisories/CVE-2024-10302/https://agentprime.io/advisories/CVE-2024-10302/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:01 GMTCVECVE-2024-6832: Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-6832/https://agentprime.io/advisories/CVE-2024-6832/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:59 GMTCVECVE-2024-8995: Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2024-8995/https://agentprime.io/advisories/CVE-2024-8995/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:56 GMTCVECVE-2026-2445: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modificationhttps://agentprime.io/advisories/CVE-2026-2445/https://agentprime.io/advisories/CVE-2026-2445/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 08:06:39 GMTCVECVE-2025-8591: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modificationhttps://agentprime.io/advisories/CVE-2025-8591/https://agentprime.io/advisories/CVE-2025-8591/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:53 GMTCVECVE-2024-1248: Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalationhttps://agentprime.io/advisories/CVE-2024-1248/https://agentprime.io/advisories/CVE-2024-1248/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Jul 2026 20:38:49 GMTCVECVE-2025-13475: Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposurehttps://agentprime.io/advisories/CVE-2025-13475/https://agentprime.io/advisories/CVE-2025-13475/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Jul 2026 12:49:06 GMTCVECVE-2025-10470: Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailabilityhttps://agentprime.io/advisories/CVE-2025-10470/https://agentprime.io/advisories/CVE-2025-10470/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 10:16:52 GMTCVECVE-2025-9973: Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeoverhttps://agentprime.io/advisories/CVE-2025-9973/https://agentprime.io/advisories/CVE-2025-9973/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 10:12:39 GMTCVECVE-2025-10908: Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2025-10908/https://agentprime.io/advisories/CVE-2025-10908/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 09:01:43 GMTCVECVE-2024-0391: Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-0391/https://agentprime.io/advisories/CVE-2024-0391/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 08:45:33 GMTCVE