Product by WSO2

    Wso2 Identity Server

    78 known vulnerabilities in Wso2 Identity Server (WSO2), 0 of them actively exploited (CISA KEV).

    Key figures

    78

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Wso2 Identity Server (WSO2)
    CriticalCVE-2025-15039

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    also in 18 other products

    		9.4
    CriticalCVE-2025-10611

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    also in 17 other products

    		9.8
    CriticalCVE-2024-4457

    WSO2 Enterprise Integrator: OS Command Injection

    also in 6 other products

    		9.1
    CriticalCVE-2024-6914

    WSO2 API Manager: Incorrect Authorization

    also in 11 other products

    		9.8
    CriticalCVE-2025-9804

    WSO2 API Manager: Improper Access Control

    also in 24 other products

    		9.6
    HighCVE-2025-12737

    WSO2 Open Banking AM: OS Command Injection

    also in 15 other products

    		8.4
    HighCVE-2025-14260

    WSO2 API Manager: Server-Side Request Forgery (SSRF)

    also in 4 other products

    		8.3
    HighCVE-2025-3125

    WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type

    also in 15 other products

    		6.7
    HighCVE-2025-10907

    WSO2 API Manager: Unrestricted Upload of File with Dangerous Type

    also in 19 other products

    		8.4
    HighCVE-2025-10149

    Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

    also in 2 other products

    		8.2
    HighCVE-2024-6832

    WSO2 Enterprise Integrator: Protection Mechanism Failure

    also in 17 other products

    		7.5
    HighCVE-2026-6647

    WSO2 Identity Server: Insufficient Session Expiration

    also in 1 other product

    		7.4
    HighCVE-2025-0326

    Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

    also in 1 other product

    		7.4
    HighCVE-2025-10470

    WSO2 Identity Server: Uncontrolled Resource Consumption

    also in 2 other products

    		8.6
    CriticalCVE-2025-9312

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    also in 17 other products

    		9.8
    MediumCVE-2025-13173

    WSO2 API Control Plane: Insufficient Session Expiration

    also in 8 other products

    		6.5
    MediumCVE-2024-5139

    WSO2 Enterprise Integrator: Cross-site Scripting

    also in 5 other products

    		6.1
    MediumCVE-2024-8122

    Potential brute force vulnerability due to non-expiring SMS OTPs

    		5.9
    CriticalCVE-2024-2374

    WSO2 API Manager: Improper Restriction of XML External Entity Reference

    also in 9 other products

    		7.5
    MediumCVE-2026-11854

    Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

    also in 2 other products

    		6.1
    HighCVE-2025-1862

    WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type

    also in 7 other products

    		6.7
    MediumCVE-2024-7478

    WSO2 API Manager: Observable Response Discrepancy

    also in 5 other products

    		5.8
    MediumCVE-2025-5350

    SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

    also in 18 other products

    		5.9
    MediumCVE-2025-13591

    WSO2 Identity Server: Observable Discrepancy

    also in 1 other product

    		5.3
    MediumCVE-2025-5605

    WSO2 Identity Server: Authentication Bypass

    also in 18 other products

    		4.3

    All vulnerabilities in search

    News

    All products by WSO2