CVE-2026-5430

The CVE-2026-5430 issue is a JWT authentication bypass in WSO2 products, where tokens signed with unsupported algorithms are accepted due to improper validation. This allows an attacker to forge a JWT and gain unauthorized access, potentially compromising administrative accounts and enabling full...

CVE-2025-15039

CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...

CVE-2026-0637

The CVE pertains to WS02 products where an Event Publisher output adapter configured with irrelevant properties logs those properties without proper validation or sanitization. This can expose sensitive data (e.g., user credentials) to anyone with access to the wso2carbon logs, enabling unauthori...

CVE-2024-6832

CVE-2024-6832 describes an account locking failure in multiple WSO2 products where the lockout is not triggered if secondary user stores are inaccessible. The root cause is that the system does not maintain a consistent lockout state across all configured stores, enabling an attacker to perform r...

CVE-2024-8995

This CVE describes that unused authorization codes issued to deleted users are not properly invalidated or removed, allowing an attacker who has both the authorization code and the associated client credentials to obtain access tokens on behalf of deleted users. The CVE notes the impact is unauth...

CVE-2025-13394

The CVE-2025-13394 entry describes a CSRF issue in the Carbon console's Ajax processor. State-changing operations are performed via HTTP GET, and while SameSite=Lax cookies are used, this mitigation is bypassed for cross-origin top-level navigation, allowing an authenticated user’s browser to tri...

CVE-2026-1728

CVE-2026-1728 affects WSO2 products. Tokens issued to low-privilege users are not sufficiently restricted, enabling access to product-level Admin REST APIs and potentially enabling full administrative account takeover. Affected component is the token/session handling that can be exploited to invo...

CVE-2026-4249

The CVE-2026-4249 affects multiple WSO2 products where the throttling event handling accepts unvalidated JSON payloads. The underlying issue is insufficient validation of the structure/content, enabling an unauthenticated remote attacker to inject malicious JSON that can cause a persistent denial...

CVE-2025-13590

The CVE-2025-13590 entry describes an authenticated arbitrary file upload via a System REST API that requires administrator permissions. The vulnerability allows an admin-restricted user to upload a file to a user-controlled location, with the potential consequence of remote code execution. CVSS ...

CVE-2025-8591

The CVE-2025-8591 entry describes a reflected cross-site scripting flaw in multiple WSO2 products, triggered by reflecting user-supplied input from a URL parameter without sufficient output encoding. The vulnerability allows an attacker to cause the user’s browser to redirect to a malicious site,...

CVE-2025-6670

Summary: CVE-2025-6670 describes a CSRF vulnerability in multiple WSO2 products due to using HTTP GET for state-changing admin service operations in the Carbon console event processor. Despite SameSite=Lax mitigation, the cookie attribute is ineffective for cross-origin top-level navigations, all...

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...