Vulnerabilities in WSO2
131 resultsCVE-2024-4412LOWExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsEPSS 0.4%CVE-2026-2613HIGHSQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service DisruptionEPSS 0.4%CVE-2025-9973MEDIUMAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account TakeoverEPSS 0.4%CVE-2026-4052CRITICALPrivilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)EPSS 0.4%CVE-2026-3416MEDIUMPredictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event PayloadsEPSS 0.4%CVE-2025-11229HIGHPrivilege Escalation via Client Credentials Grant Type in WSO2 Identity ServerEPSS 0.4%CVE-2025-13909MEDIUMInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII ExposureEPSS 0.3%CVE-2024-6541MEDIUMInformation Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 ProductsEPSS 0.3%CVE-2025-5802MEDIUMUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2024-7487MEDIUMImproper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationEPSS 0.3%CVE-2024-4598MEDIUMInformation Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich MediatorEPSS 0.3%CVE-2025-11969CRITICALBroken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsEPSS 0.3%CVE-2025-14779LOWImproper Access Control via Secret Type Management API in WSO2 Identity ServerEPSS 0.3%CVE-2025-10470HIGHDenial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service UnavailabilityEPSS 0.3%CVE-2025-11850MEDIUMImproper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]EPSS 0.3%CVE-2024-1248MEDIUMRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationEPSS 0.3%CVE-2026-4103MEDIUMCross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script ExecutionEPSS 0.3%CVE-2024-1524HIGHA local user can be impersonated when using federated authentication with Silent JIT Provisioning.EPSS 0.3%CVE-2025-13591MEDIUMUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2024-10302MEDIUMImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureEPSS 0.3%