The vulnerability identified as CVE-2024-10302 affects WSO2 API Control Plane version 4.5.0. It stems from improper input validation (CWE-20) in the user self-signup process, where arbitrary unvalidated data can be injected into user claims. These claims are subsequently consumed by other parts of the application, potentially enabling various security risks such as content manipulation, unauthorized actions, and data exposure. The impact depends on the context in which the compromised claims are used and the privileges of the user accounts involved. No known exploits are reported in the wild, and no official remediation or patch has been disclosed by the vendor as of the published date.

Unvalidated input in user claims can lead to several security risks including content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact varies based on how the compromised claims are processed and the privileges of the affected users. There is no indication of confidentiality loss or availability impact, and the CVSS vector reflects no confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting or validating user input in the signup flow as a temporary mitigation if feasible.