WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

CVE-2022-29464

CVE-2022-29464 WSO2 is a leading provider of various SOA solutions, including SOA-related infrastructure, technical frameworks, and related tools, process servers, application servers, etc. Affected Versions 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Serv...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 is a critical vulnerability in WSO2 Identity Server, an open-source identity and access management platform. The vulnerability allows remote attackers to upload malicious JSP files that can execute arbitrary commands on the target system with administrative privilege...

CVE-2025-11229

WSO2 Identity Server is vulnerable to a privilege escalation flaw when the authorize_all_scopes configuration is enabled. The system fails to properly enforce scope authorization, allowing applications using the client credentials grant type to obtain all API scopes—including sensitive internal a...

CVE-2025-11229 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

The system fails to properly enforce scope authorization when the authorizeallscopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization,...

CVE-2026-4052

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

EUVD-2026-115721

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052

CVE-2026-4052 affects WSO2 API Manager (APIM 4.x) when the WSO2 Identity Server is configured as a Resident Key Manager with database sharing . The vulnerability allows a self-registered user to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO...

PT-2026-136041

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 Description A privilege escalation issue exists where a self-registered user can gain unauthorized access to the System REST APIs. This occurs in deployments where WSO2 Identity Server is configure...

WSO2 Identity Server information disclosure vulnerability

Vulnerabilities related to information disclosure exist in WSO2 Identity Server versions prior to 5.10.0 through 5.10.0.381, 5.11.0 through 5.11.0.428, 6.0.0 through 6.0.0.255, 6.1.0 through 6.1.0.255, 7.0.0 through 7.0.0.133, 7.1.0 through 7.1.0.41, and 7.2.0 through 7.2.0.3. This vulnerability...

CVE-2024-12141: WSO2 WSO2 Identity Server: The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when…

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an...

CLEANSTART-2026-PV27623 improper authentication vulnerability exists in WSO2 Identity Server 7

Security vulnerability affects the wso2is package. An improper authentication vulnerability exists in WSO2 Identity Server 7...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647

The WSO2 Identity Server is vulnerable to incomplete OAuth token revocation due to a case mismatch between a case-insensitive user store and a case-sensitive database. When usernames contain mixed-case characters, revocation operations during certain lifecycle events may fail to identify the corr...