Advisories · Technology

WSO2 Open Banking AM.

Every CVE that names WSO2 Open Banking AM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-1397 CVE record

CVSS 4.8 Medium

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2024-9517 CVE record

CVSS 4.9 Medium

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
- WSO2 API Manager
- WSO2 Universal Gateway
- Authentication bypass
Not analysed yet 2 Nov 2026
CVE-2024-2372 CVE record

CVSS 5.4 Medium

Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
- WSO2 Open Banking AM
- WSO2 API Manager
- Open redirect
Not analysed yet 2 Nov 2026
CVE-2026-18800 CVE record

CVSS 4.4 Medium

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
- WSO2 API Manager
- WSO2 Traffic Manager
- Information disclosure
Not analysed yet 2 Nov 2026
CVE-2025-11969 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Broken access control
Not analysed yet 2 Nov 2026
CVE-2026-3583 CVE record

CVSS 3.1 Low

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass
Not analysed yet 28 Oct 2026
CVE-2025-14260 CVE record

CVSS 8.3 High

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Server-side request forgery (SSRF)
Not analysed yet 28 Oct 2026
CVE-2024-6423 CVE record

CVSS 4.0 Medium

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
- WSO2 API Manager
- WSO2 Open Banking AM
- CWE-20
Not analysed yet 21 Oct 2026
CVE-2024-7478 CVE record

CVSS 5.8 Medium

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- CWE-204
Not analysed yet 21 Oct 2026
CVE-2024-5139 CVE record

CVSS 6.1 Medium

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Cross-site scripting (XSS)
Not analysed yet 21 Oct 2026
CVE-2024-2323 CVE record

CVSS 4.8 Medium

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
Not analysed yet 20 Oct 2026
CVE-2024-4412 CVE record

CVSS 2.7 Low

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 19 Oct 2026
CVE-2025-13173 CVE record

CVSS 6.5 Medium

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- WSO2 API Control Plane
- WSO2 Universal Gateway
- Authentication bypass
Not analysed yet 19 Oct 2026
CVE-2024-4457 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Command injection
Not analysed yet 18 Oct 2026
CVE-2025-5802 CVE record

CVSS 5.3 Medium

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
- WSO2 API Manager
- WSO2 API Control Plane
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2025-12737 CVE record

CVSS 8.4 High

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Command injection
Not analysed yet 3 Sept 2026
CVE-2025-15039 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 API Manager
- CWE-693
Not analysed yet 6 Aug 2026
CVE-2025-13394 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site request forgery (CSRF)
Not analysed yet 6 Aug 2026
CVE-2025-13736 CVE record

CVSS 3.7 Low

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Information disclosure
Not analysed yet 6 Aug 2026
CVE-2024-6832 CVE record

CVSS 5.9 Medium

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- WSO2 Enterprise Integrator
- WSO2 API Control Plane
- CWE-693
Not analysed yet 6 Aug 2026
CVE-2024-8995 CVE record

CVSS 4.9 Medium

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass
Not analysed yet 6 Aug 2026
CVE-2025-8591 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 6 Jul 2026
CVE-2024-1248 CVE record

CVSS 4.8 Medium

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
- WSO2 API Manager
- WSO2 Identity Server
- CWE-298
Not analysed yet 4 Jul 2026
CVE-2024-2374 CVE record

CVSS 7.5 High

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
- WSO2 API Manager
- WSO2 Identity Server
- XML external entities (XXE)
Not analysed yet 16 Apr 2026
CVE-2025-9312 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- WSO2 API Manager
- WSO2 API Control Plane
- Authentication bypass
Not analysed yet 18 Nov 2025
CVE-2025-6670 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-10853 CVE record

CVSS 5.2 Medium

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
- WSO2 Open Banking IAM
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2025
CVE-2025-11093 CVE record

CVSS 8.4 High

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- WSO2 Micro Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 5 Nov 2025
CVE-2025-10907 CVE record

CVSS 8.4 High

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
- WSO2 API Manager
- WSO2 Open Banking IAM
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-5605 CVE record

CVSS 4.3 Medium

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Authentication bypass
Not analysed yet 24 Oct 2025
CVE-2025-5350 CVE record

CVSS 5.9 Medium

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
Not analysed yet 24 Oct 2025
CVE-2025-9804 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-10611 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-5717 CVE record

CVSS 6.8 Medium

Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
- WSO2 API Manager
- WSO2 Open Banking AM
- Code injection
Not analysed yet 23 Sept 2025
CVE-2024-3511 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
Not analysed yet 23 Jun 2025
CVE-2024-3509 CVE record

CVSS 4.3 Medium

Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 2 Jun 2025
CVE-2024-7074 CVE record

CVSS 6.8 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Unrestricted file upload
Not analysed yet 2 Jun 2025
CVE-2024-7097 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- WSO2 Open Banking AM
- WSO2 Open Banking KM
- Broken access control
Not analysed yet 30 May 2025
CVE-2024-6914 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- WSO2 API Manager
- WSO2 Governance Registry
- Broken access control
Not analysed yet 22 May 2025
CVE-2024-5848 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation
- WSO2 API Manager
- WSO2 Open Banking AM
- Cross-site scripting (XSS)
Not analysed yet 27 Feb 2025