CVE-2025-13394

🗓️ 06 Aug 2026 08:16:28Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 11 Views

Carbon console CSRF via get requests; SameSite lax can be bypassed, enabling unauthorized state changes when exposed publicly.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2025-13394	6 Aug 202607:33	–	attackerkb
Circl	CVE-2025-13394	8 Aug 202616:58	–	circl
CVE	CVE-2025-13394	6 Aug 202607:33	–	cve
Cvelist	CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions	6 Aug 202607:33	–	cvelist
EUVD	EUVD-2025-210631	6 Aug 202607:33	–	euvd
Positive Technologies	PT-2026-68442	6 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2025-13394 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions	6 Aug 202607:33	–	vulnrichment

NVD

Node

OR

wso2 api_control_planeRange4.5.0–4.5.0.39

wso2 api_control_planeRange4.6.0–4.6.0.3

wso2 api_managerRange3.1.0–3.1.0.352

wso2 api_managerRange3.2.0–3.2.0.456

wso2 api_managerRange3.2.1–3.2.1.75

wso2 api_managerRange4.0.0–4.0.0.376

wso2 api_managerRange4.1.0–4.1.0.239

wso2 api_managerRange4.2.0–4.2.0.179

wso2 api_managerRange4.3.0–4.3.0.91

wso2 api_managerRange4.4.0–4.4.0.55

wso2 api_managerRange4.5.0–4.5.0.38

wso2 api_managerRange4.6.0–4.6.0.3

wso2 enterprise_integratorRange6.6.0–6.6.0.227

wso2 identity_serverRange5.10.0–5.10.0.381

wso2 identity_serverRange5.11.0–5.11.0.428

wso2 identity_serverRange6.0.0–6.0.0.255

wso2 identity_serverRange6.1.0–6.1.0.256

wso2 identity_serverRange7.0.0–7.0.0.133

wso2 identity_serverRange7.1.0–7.1.0.41

wso2 identity_serverRange7.2.0–7.2.0.3

wso2 identity_server_as_key_managerRange5.10.0–5.10.0.372

wso2 open_banking_amRange2.0.0–2.0.0.401

wso2 open_banking_iamRange2.0.0–2.0.0.421

wso2 traffic_managerRange4.5.0–4.5.0.37

wso2 traffic_managerRange4.6.0–4.6.0.3

wso2 universal_gatewayRange4.5.0–4.5.0.37

wso2 universal_gatewayRange4.6.0–4.6.0.3

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/

12 Aug 2026 19:53Current

CVSS 3.15.4

EPSS0.001

cross site forgery get requests same site lax carbon console public exposure unauthorized state changes