Wso2 Universal Gateway (Wso2) - vulnerabilities (CVEs)

26 CVEs, 5 in the last 30 days, 2 known versions, newest CVE from 2026-10-28. Vendor: Wso2.

CVEs of Wso2 Universal Gateway

CVE-2026-3583 - CVSS 3.1 (low), 2026-10-28: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a…
CVE-2025-13173 - CVSS 6.5 (medium), 2026-10-19: Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs…
CVE-2025-7203 - CVSS 4.9 (medium), 2026-10-19: The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in…
CVE-2025-7043 - CVSS 5.4 (medium), 2026-10-19: The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for…
CVE-2025-6623 - CVSS 4.3 (medium), 2026-10-19: The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious…
CVE-2025-5802 - CVSS 5.3 (medium), 2026-09-15: The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts…
CVE-2025-12737 - CVSS 8.4 (high), 2026-09-03: The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with…
CVE-2026-3418 - CVSS 9.1 (critical), 2026-08-06: The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written…
CVE-2026-3415 - CVSS 8.7 (high), 2026-08-06: The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the…
CVE-2025-14561 - CVSS 9 (critical), 2026-08-06: In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient…
CVE-2026-5430 - CVSS 10 (critical), 2026-08-06: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a…
CVE-2026-1728 - CVSS 9.8 (critical), 2026-08-06: Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this…
CVE-2025-15039 - CVSS 9.4 (critical), 2026-08-06: The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific…
CVE-2026-0637 - CVSS 4.4 (medium), 2026-08-06: When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without…
CVE-2025-13394 - CVSS 5.4 (medium), 2026-08-06: The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks.…
CVE-2024-10302 - CVSS 5.8 (medium), 2026-08-06: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be…
CVE-2024-6832 - CVSS 7.5 (high), 2026-08-06: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account…
CVE-2024-8995 - CVSS 4.9 (medium), 2026-08-06: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these…
CVE-2026-4249 - CVSS 8.6 (high), 2026-07-06: The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and…
CVE-2025-8591 - CVSS 6.1 (medium), 2026-07-06: The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition…
CVE-2025-8325 - CVSS 8.8 (high), 2026-05-11: The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs,…
CVE-2025-8154 - CVSS 7.5 (high), 2026-05-11: In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these…
CVE-2025-13590 - CVSS 9.1 (critical), 2026-02-19: A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API.…
CVE-2025-9312 - CVSS 9.8 (critical), 2025-11-18: A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2…
CVE-2025-6670 - CVSS 8.8 (high), 2025-11-18: A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within…
CVE-2025-10853 - CVSS 6.1 (medium), 2025-11-05: A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering…
CVE-2025-11093 - CVSS 8.4 (high), 2025-11-05: An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator…
CVE-2025-10907 - CVSS 8.4 (high), 2025-11-05: An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin…
CVE-2025-10713 - CVSS 9.1 (critical), 2025-11-05: An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses…
CVE-2025-3125 - CVSS 7.2 (high), 2025-11-05: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An…
CVE-2025-5605 - CVSS 5.3 (medium), 2025-10-24: An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate…
CVE-2025-5350 - CVSS 5.9 (medium), 2025-10-24: SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative…
CVE-2025-9804 - CVSS 9.6 (critical), 2025-10-16: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services…
CVE-2025-10611 - CVSS 9.8 (critical), 2025-10-16: Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed,…
CVE-2025-4760 - CVSS 4.8 (medium), 2025-09-23: An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API…
CVE-2024-8008 - CVSS 5.2 (medium), 2025-06-02: A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the…