carbon-identity-framework

carbon-identity-framework 브랜치| 빌드 상태 ---|--- master| 이 저장소에는 WSO2 Identity Server 제품에 필요한 핵심 구성 요소와 기능이 포함되어 있습니다. 소스에서 빌드 소스 코드에서 carbon-identity-framework 를 빌드하려면: 1. Java 21을 설치합니다. 2. Apache Maven 3.x.x를 설치합니다. https://maven.apache.org/download.cgi 3. 이 저장소에서 소스를 클론하거나 다운로드합니다...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 is a critical vulnerability in WSO2 Identity Server, an open-source identity and access management platform. The vulnerability allows remote attackers to upload malicious JSP files that can execute arbitrary commands on the target system with administrative privilege...

WSO2RCE

WSO2RCE CVE-2022-29464는 WSO2 API Manager 및 WSO2 Open Banking 과 같은 일부 WSO2 제품에 영향을 미치며, 임의 파일 업로드 및 원격 코드 실행을 허용합니다. 영향을 받는 제품: WSO2 API Manager 2.2.0 4.0.0 WSO2 Identity Server 5.2.0 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 WSO2 Identity Server as Key Manager 5.3.0 5.11.0...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2025-12627

WSO2 Identity Server is affected by CVE-2025-12627 due to improper refresh token handling in the user impersonation flow. If an attacker has an impersonated access token, they can use the refresh_token grant to obtain new access tokens, extending their ability to act as the impersonated user. Thi...

CVE-2025-14779 Improper Access Control via Secret Type Management API in WSO2 Identity Server

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...

CVE-2025-12627: Insufficient Session Expiration

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-12624

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security...

CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that...

CVE-2025-9973

CVE-2025-9973 affects WS O2 Identity Server: failure to validate the organization context during adaptive authentication allows triggering authentication logic in other organizations/sub-organizations. This enables cross-organization authorization bypass, potentially leading to privilege escalati...

CVE-2025-9973 Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization ca...

CVE-2025-9973 Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization ca...

WSO2 Identity Server 访问控制错误漏洞

WSO2 Identity Server is an identity authentication server developed by the American company WSO2. WSO2 Identity Server has a control access vulnerability that arises from the lack of verification of organizational context during the execution of adaptive authentication processes. This vulnerabili...

WSO2 Identity Server 安全漏洞

WSO2 Identity Server is an identity authentication server developed by the American company WSO2. WSO2 Identity Server has a security vulnerability that stems from the lack of verification of user account status. This vulnerability may allow locked accounts to be successfully authenticated throug...

CVE-2025-9973: Improper Access Control

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization ca...

CVE-2025-10503

WSO2 Identity Server: CVE-2025-10503 is a reflected cross-site scripting flaw in the authentication endpoint caused by insufficient output encoding for user-supplied input. This allows injection of malicious JavaScript payloads that can redirect users, alter the UI, or retrieve information from t...

CVE-2025-10503 Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this...