carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| 此仓库包含 WSO2 Identity Server 产品所需的核心组件和功能。 从源码构建 如果你想从源码构建 carbon-identity-framework ： 1. 安装 Java 21。 2. 安装 Apache Maven 3.x.x（https://maven.apache.org/download.cgi） 3. 从本仓库获取克隆或下载源码（https://github.com/wso2/carbon-identity-framework.git...

WSO2RCE

WSO2RCE CVE-2022-29464 影响部分 WSO2 产品，如 WSO2 API Manager 和 WSO2 Open Banking ，允许任意文件上传和远程代码执行。 受影响产品： WSO2 API Manager 2.2.0 到 4.0.0 WSO2 Identity Server 5.2.0 到 5.11.0 WSO2 Identity Server Analytics 5.4.0、5.4.1、5.5.0、5.6.0 WSO2 Identity Server as Key Manager 5.3.0 到 5.11.0 WSO2 Enterprise Integrat...

CVE-2022-29464

CVE-2022-29464 WSO2 是一个领先的各种 SOA 解决方案，包含了 SOA 相关的基础设施、技术框架和相关工具、流程服务器、应用服务器等。 影响范围 2.2.0 ≤ WSO2 API 管理器 ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 5.3.0 ≤ WSO2 Identity Server as Key Manager ≤ 5.10.0 6.2.0 ≤ WSO2 Enterprise Integrator ≤...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 是 WSO2 Identity Server（一个开源的身份与访问管理平台）中的一个严重漏洞。该漏洞允许远程攻击者上传恶意的 JSP 文件，从而在目标系统上以管理员权限执行任意命令。该漏洞是一个文件上传功能问题，通过绕过文件扩展名验证机制来利用。该漏洞的 CVSS 评分为 9.8，表明其严重性。 示例 Dorks title:"WSO2 Carbon Server" 截图 运行要求 Python3.7+ 支持的操作系统 Linux 系统 Windows 系统 开始使用 $ git clone...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CLEANSTART-2026-QG86215 Security fixes in wso2is 7.1.0-r0

Package wso2is version 7.1.0-r0 fixes 17 vulnerabilities: CVE-2025-8671, CVE-2025-23184, CVE-2025-48734, CVE-2025-48795, CVE-2025-48924...

CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2025-12627

WSO2 Identity Server is affected by CVE-2025-12627 due to improper refresh token handling in the user impersonation flow. If an attacker has an impersonated access token, they can use the refresh_token grant to obtain new access tokens, extending their ability to act as the impersonated user. Thi...

EUVD-2025-210629

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-12627 Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-14779 Improper Access Control via Secret Type Management API in WSO2 Identity Server

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...

PT-2026-68441

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server affected versions not specified Description The user impersonation flow fails to properly manage refresh tokens associated with impersonated sessions. An attacker who obtains an access token for an impersonated user can us...

CVE-2025-12627: Insufficient Session Expiration

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

PT-2026-60788

Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint witho...

CVE-2026-31016

A Cross Site Request Forgery (CSRF) vulnerability exists in Squidex.io Squidex CMS versions v.7.21.0 and before . A remote attacker can exploit this issue to escalate privileges by targeting the IdentityServer account profile endpoint , which is used for managing user account details. To remediat...

CVE-2025-12624

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security...

CVE-2025-9973

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization ca...