The vulnerability CVE-2024-10302 affects WSO2 API Control Plane version 4.5.0 and arises from improper input validation (CWE-20) in the user self-signup flow. User-supplied input is not adequately validated before inclusion in user claims. These claims are then used by downstream components, potentially allowing malicious or malformed data to influence application behavior. The impact varies based on how the compromised claims are processed and the privileges of the users involved. The CVSS v3.1 base score is 4.0, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, low integrity impact, and no availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows arbitrary unvalidated data to be injected into user claims during the self-signup process. This can lead to content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure depending on downstream processing and user privileges. The CVSS score of 4.0 indicates a medium impact primarily affecting integrity with no confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or monitoring the user self-signup process and validate user claims in downstream components where possible to mitigate risks.