CVE-2026-4052

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

EUVD-2026-115721

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052

CVE-2026-4052 affects WSO2 API Manager (APIM 4.x) when the WSO2 Identity Server is configured as a Resident Key Manager with database sharing . The vulnerability allows a self-registered user to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

CVE-2022-29548

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 Write-up: https://abraxaslabs.tech/research/CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up...

WSO2 API Manager server request forgery vulnerability

Versions 3.1.0 through 3.1.0.354, 3.2.0 through 3.2.0.458, 3.2.1 through 3.2.1.99, 4.0.0 through 4.0.0.379, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.115, and 4.4.0 through 4.4.0.79 of WSO2 API Manager contain a server-side request forgery vulnerability. This...

WSO2 API Manager cross-site scripting vulnerability

Versions 3.2.0 through 3.2.0.480, 3.2.1 through 3.2.1.99, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.117, 4.4.0 through 4.4.0.80, 4.5.0 through 4.5.0.65, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.1 of WSO2 API Manager; versions 4.5.0 through 4.5.0.66, 4.6.0 throug...

WSO2 API Manager session mechanism vulnerability

Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...

CVE-2024-4989

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989

The WSO2 API Manager is vulnerable to an open redirection flaw due to the callback URL parameter failing to validate user-supplied input. Malicious actors can control this parameter to redirect users to arbitrary web pages. This vulnerability can be leveraged in social engineering schemes to perf...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

EUVD-2024-55811

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989: URL Redirection to Untrusted Site

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

WSO2 API Manager input validation error vulnerability

Versions prior to WSO2 API Manager 3.1.0.313; versions prior to 3.2.0.406 for 3.2.0; versions prior to 3.2.1.30 for 3.2.1; versions prior to 4.0.0.324 for 4.0.0; versions prior to 4.1.0.185 for 4.1.0; versions prior to 4.2.0.124 for 4.2.0; versions prior to 4.3.0.36 for 4.3.0 and versions prior t...

PT-2026-120599

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

WSO2 Enterprise Integrator cross-site scripting vulnerability

WSO2 Enterprise Integrator versions prior to 6.6.0 and 6.6.0.204; WSO2 Identity Server versions prior to 5.10.0 and 5.10.0.310, 6.0.0 and 6.0.0.212, 6.1.0 and 6.1.0.195, and 7.0.0 and 7.0.0.64; WSO2 API Manager versions prior to 3.1.0 and 3.1.0.286, 3.2.0 and 3.2.0.376, 3.2.1 and 3.2.1.10, 4.0.0...