Wso2 Api Manager (Wso2) - vulnerabilities (CVEs)

43 CVEs, 12 in the last 30 days, 8 known versions, newest CVE from 2026-10-28. Vendor: Wso2.

CVEs of Wso2 Api Manager

CVE-2026-3583 - CVSS 3.1 (low), 2026-10-28: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a…
CVE-2026-11854 - CVSS 6.1 (medium), 2026-10-28: The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding.…
CVE-2025-14260 - CVSS 8.3 (high), 2026-10-28: Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing…
CVE-2024-6423 - CVSS 4 (medium), 2026-10-21: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not…
CVE-2024-7478 - CVSS 5.8 (medium), 2026-10-21: When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during…
CVE-2024-4989 - CVSS 5.4 (medium), 2026-10-21: The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this…
CVE-2024-5139 - CVSS 6.1 (medium), 2026-10-21: The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This…
CVE-2024-2323 - CVSS 4.8 (medium), 2026-10-20: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This…
CVE-2024-4412 - CVSS 2.7 (low), 2026-10-19: The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to…
CVE-2025-13173 - CVSS 6.5 (medium), 2026-10-19: Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs…
CVE-2025-7203 - CVSS 4.9 (medium), 2026-10-19: The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in…
CVE-2025-7043 - CVSS 5.4 (medium), 2026-10-19: The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for…
CVE-2025-6623 - CVSS 4.3 (medium), 2026-10-19: The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious…
CVE-2024-4457 - CVSS 9.1 (critical), 2026-10-18: The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially…
CVE-2025-5802 - CVSS 5.3 (medium), 2026-09-15: The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts…
CVE-2026-4103 - CVSS 6.4 (medium), 2026-09-14: Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or…
CVE-2026-3096 - CVSS 4.7 (medium), 2026-09-10: The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the…
CVE-2025-12737 - CVSS 8.4 (high), 2026-09-03: The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with…
CVE-2026-3416 - CVSS 7.5 (high), 2026-09-03: The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation.…
CVE-2026-3418 - CVSS 9.1 (critical), 2026-08-06: The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written…
CVE-2026-3415 - CVSS 8.7 (high), 2026-08-06: The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the…
CVE-2025-14561 - CVSS 9 (critical), 2026-08-06: In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient…
CVE-2025-6508 - CVSS 4.3 (medium), 2026-08-06: The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API…
CVE-2024-6541 - CVSS 6.8 (medium), 2026-08-06: The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows…
CVE-2026-5430 - CVSS 10 (critical), 2026-08-06: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a…
CVE-2026-1728 - CVSS 9.8 (critical), 2026-08-06: Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this…
CVE-2025-15039 - CVSS 9.4 (critical), 2026-08-06: The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific…
CVE-2026-0637 - CVSS 4.4 (medium), 2026-08-06: When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without…
CVE-2025-13394 - CVSS 5.4 (medium), 2026-08-06: The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks.…
CVE-2025-13736 - CVSS 3.7 (low), 2026-08-06: When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and…
CVE-2024-10302 - CVSS 5.8 (medium), 2026-08-06: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be…
CVE-2024-6832 - CVSS 7.5 (high), 2026-08-06: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account…
CVE-2024-8995 - CVSS 4.9 (medium), 2026-08-06: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these…
CVE-2026-2445 - CVSS 6.1 (medium), 2026-07-20: The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the…
CVE-2026-4249 - CVSS 8.6 (high), 2026-07-06: The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and…
CVE-2025-8591 - CVSS 6.1 (medium), 2026-07-06: The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition…
CVE-2024-1248 - CVSS 5.3 (medium), 2026-07-04: The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation…
CVE-2025-13475 - CVSS 7.3 (high), 2026-07-04: In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a…
CVE-2026-2053 - CVSS 10 (critical), 2026-06-26: The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within…
CVE-2025-8325 - CVSS 8.8 (high), 2026-05-11: The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs,…
CVE-2025-8154 - CVSS 7.5 (high), 2026-05-11: In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these…
CVE-2024-8010 - CVSS 7.5 (high), 2026-04-16: The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML…
CVE-2025-6024 - CVSS 6.1 (medium), 2026-04-16: The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage…
CVE-2024-4867 - CVSS 5.4 (medium), 2026-04-16: The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency…
CVE-2024-10242 - CVSS 6.1 (medium), 2026-04-16: The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject…
CVE-2024-2374 - CVSS 9.1 (critical), 2026-04-16: The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This…
CVE-2024-1524 - CVSS 8.1 (high), 2026-02-24: When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's…
CVE-2025-13590 - CVSS 9.1 (critical), 2026-02-19: A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API.…
CVE-2025-9312 - CVSS 9.8 (critical), 2025-11-18: A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2…
CVE-2025-6670 - CVSS 8.8 (high), 2025-11-18: A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within…
CVE-2025-10853 - CVSS 6.1 (medium), 2025-11-05: A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering…
CVE-2025-5770 - CVSS 6.1 (medium), 2025-11-05: A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A…
CVE-2025-11093 - CVSS 8.4 (high), 2025-11-05: An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator…
CVE-2025-10907 - CVSS 8.4 (high), 2025-11-05: An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin…
CVE-2025-10713 - CVSS 9.1 (critical), 2025-11-05: An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses…
CVE-2025-3125 - CVSS 7.2 (high), 2025-11-05: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An…
CVE-2025-5605 - CVSS 5.3 (medium), 2025-10-24: An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate…
CVE-2025-5350 - CVSS 5.9 (medium), 2025-10-24: SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative…
CVE-2025-9804 - CVSS 9.6 (critical), 2025-10-16: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services…
CVE-2025-9152 - CVSS 9.8 (critical), 2025-10-16: An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations…
CVE-2025-10611 - CVSS 9.8 (critical), 2025-10-16: Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed,…
CVE-2024-6429 - CVSS 4.3 (medium), 2025-09-23: A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed…
CVE-2025-5717 - CVSS 7.2 (high), 2025-09-23: An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin…
CVE-2025-4760 - CVSS 4.8 (medium), 2025-09-23: An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API…
CVE-2024-4598 - CVSS 6.5 (medium), 2025-09-23: An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be…
CVE-2024-3511 - CVSS 4.3 (medium), 2025-06-23: An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to…
CVE-2024-8008 - CVSS 5.2 (medium), 2025-06-02: A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the…
CVE-2024-7074 - CVSS 6.8 (medium), 2025-06-02: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor…
CVE-2024-3509 - CVSS 4.3 (medium), 2025-06-02: A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich…
CVE-2024-1440 - CVSS 6.1 (medium), 2025-06-02: An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when…
CVE-2024-7096 - CVSS 5.4 (medium), 2025-05-30: A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new…
CVE-2024-7097 - CVSS 4.3 (medium), 2025-05-30: An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation…
CVE-2024-5962 - CVSS 6.1 (medium), 2025-05-22: A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of…
CVE-2024-6914 - CVSS 9.8 (critical), 2025-05-22: An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A…
CVE-2025-2905 - CVSS 9.1 (critical), 2025-05-05: Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE)…
CVE-2024-5848 - CVSS 6.1 (medium), 2025-02-27: A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. User-supplied data is directly…
CVE-2024-2321 - CVSS 5.6 (medium), 2025-02-27: An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of…
CVE-2023-6911 - CVSS 4.8 (medium), 2023-12-18: Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an…
CVE-2023-6839 - CVSS 5.3 (medium), 2023-12-15: Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.
CVE-2023-6838 - CVSS 6.1 (medium), 2023-12-15: Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and…
CVE-2023-6836 - CVSS 7.5 (high), 2023-12-15: Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML…
CVE-2023-6835 - CVSS 5.3 (medium), 2023-12-15: Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.
CVE-2023-6837 - CVSS 8.5 (high), 2023-12-15: Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any…