Advisories · Technology

WSO2 Open Banking KM.

Every CVE that names WSO2 Open Banking KM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-15039 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 API Manager
- CWE-693
Not analysed yet 6 Aug 2026
CVE-2025-9312 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- WSO2 API Manager
- WSO2 API Control Plane
- Authentication bypass
Not analysed yet 18 Nov 2025
CVE-2025-9804 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-10611 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2024-7073 CVE record

CVSS 6.5 Medium

Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Server-side request forgery (SSRF)
Not analysed yet 2 Jun 2025
CVE-2024-7097 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- WSO2 Open Banking AM
- WSO2 Open Banking KM
- Broken access control
Not analysed yet 30 May 2025
CVE-2024-6914 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- WSO2 API Manager
- WSO2 Governance Registry
- Broken access control
Not analysed yet 22 May 2025