Skip to main content
Threat Radar animated logo
EPSS 0.1%top 99%

CVE-2025-13394: CWE-352: Cross-Site Request Forgery (CSRF) in WSO2 WSO2 Identity Server

0
Medium
VulnerabilityCVE-2025-13394cvecve-2025-13394cwe-352gcveosvghsa-8rr2-f52p-r9q3ghsa
Published: 08/06/2026 (08/06/2026, 07:33:17 UTC)
Source: CVE Database V5
Vendor/Project: WSO2
Product: WSO2 Identity Server

Description

CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax processor of the Carbon console within WSO2 Identity Server. The vulnerability arises because state-changing operations use the HTTP GET method and rely on the SameSite=Lax cookie attribute for CSRF mitigation, which can be bypassed. This allows attackers to trick authenticated users into unknowingly performing unauthorized actions. Exploitation requires the Carbon console and related services to be publicly accessible, which is against WSO2's security recommendations.

CVSS v3.1

Score 5.4medium

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected software

WSO2

WSO2 Identity Server

Affected versions
>=5.10.0 <5.10.0.381>=5.11.0 <5.11.0.428>=6.0.0 <6.0.0.255>=6.1.0 <6.1.0.256>=7.0.0 <7.0.0.133>=7.1.0 <7.1.0.41>=7.2.0 <7.2.0.3

WSO2

WSO2 API Manager

Affected versions
>=3.1.0 <3.1.0.352>=3.2.0 <3.2.0.456>=3.2.1 <3.2.1.75>=4.0.0 <4.0.0.376>=4.1.0 <4.1.0.239>=4.2.0 <4.2.0.179>=4.3.0 <4.3.0.91>=4.4.0 <4.4.0.55>=4.5.0 <4.5.0.38>=4.6.0 <4.6.0.3

WSO2

WSO2 Open Banking IAM

Affected versions
>=2.0.0 <2.0.0.421

WSO2

WSO2 Open Banking AM

Affected versions
>=2.0.0 <2.0.0.401

WSO2

WSO2 Identity Server as Key Manager

Affected versions
>=5.10.0 <5.10.0.372

WSO2

WSO2 API Control Plane

Affected versions
>=4.5.0 <4.5.0.39>=4.6.0 <4.6.0.3

WSO2

WSO2 Universal Gateway

Affected versions
>=4.5.0 <4.5.0.37>=4.6.0 <4.6.0.3

WSO2

WSO2 Traffic Manager

Affected versions
>=4.5.0 <4.5.0.37>=4.6.0 <4.6.0.3

WSO2

WSO2 Enterprise Integrator

Affected versions
>=6.6.0 <6.6.0.227

WSO2

WSO2 Carbon Identity Entitlement UI

Affected versions
>=5.17.5 <5.17.5.331>=5.18.187 <5.18.187.329>=5.23.8 <5.23.8.210>=5.25.92 <5.25.92.166>=7.0.78 <7.0.78.157

WSO2

WSO2 Carbon Identity Management UI1

Affected versions
>=5.17.5 <5.17.5.330>=5.17.5 <5.17.5.331>=5.17.118 <5.17.118.22>=5.18.187 <5.18.187.328>=5.18.187 <5.18.187.329>=5.18.248 <5.18.248.31>=5.23.8 <5.23.8.210>=5.24.8 <5.24.8.26>=5.25.92 <5.25.92.166>=5.25.705 <5.25.705.21>=5.25.713 <5.25.713.10>=5.25.724 <5.25.724.5>=5.25.736 <5.25.736.1>=7.0.78 <7.0.78.157>=7.8.23 <7.8.23.67>=7.8.586 <7.8.586.7

WSO2

WSO2 Carbon Identity User Store Configuration UI

Affected versions
>=5.14.127 <5.14.127.13>=5.17.5 <5.17.5.330>=5.17.5 <5.17.5.331>=5.17.118 <5.17.118.22>=5.18.187 <5.18.187.328>=5.18.187 <5.18.187.329>=5.18.248 <5.18.248.31>=5.23.8 <5.23.8.210>=5.24.8 <5.24.8.26>=5.25.92 <5.25.92.166>=5.25.705 <5.25.705.21>=5.25.713 <5.25.713.10>=5.25.724 <5.25.724.5>=5.25.736 <5.25.736.1>=7.0.78 <7.0.78.157>=7.8.23 <7.8.23.67>=7.8.586 <7.8.586.7

WSO2

WSO2 Carbon Registry Profiles UI

Affected versions
>=4.7.32 <4.7.32.18>=4.7.33 <4.7.33.16>=4.8.9 <4.8.9.16>=4.8.12 <4.8.12.8>=4.8.24 <4.8.24.6>=4.8.43 <4.8.43.4>=4.8.50 <4.8.50.3

WSO2

WSO2 Carbon Registry Properties UI

Affected versions
>=4.7.24 <4.7.24.11>=4.7.32 <4.7.32.16>=4.7.32 <4.7.32.18>=4.7.33 <4.7.33.16>=4.7.35 <4.7.35.15>=4.7.39 <4.7.39.12>=4.7.51 <4.7.51.8>=4.8.3 <4.8.3.10>=4.8.9 <4.8.9.16>=4.8.12 <4.8.12.8>=4.8.13 <4.8.13.9>=4.8.24 <4.8.24.6>=4.8.32 <4.8.32.4>=4.8.36 <4.8.36.2>=4.8.43 <4.8.43.2>=4.8.43 <4.8.43.4>=4.8.50 <4.8.50.1>=4.8.50 <4.8.50.3

WSO2

WSO2 Carbon Registry Resources UI

Affected versions
>=4.7.24 <4.7.24.11>=4.7.32 <4.7.32.16>=4.7.32 <4.7.32.18>=4.7.33 <4.7.33.16>=4.7.35 <4.7.35.15>=4.7.39 <4.7.39.12>=4.7.51 <4.7.51.8>=4.8.3 <4.8.3.10>=4.8.9 <4.8.9.16>=4.8.12 <4.8.12.8>=4.8.13 <4.8.13.9>=4.8.24 <4.8.24.6>=4.8.32 <4.8.32.4>=4.8.36 <4.8.36.2>=4.8.43 <4.8.43.2>=4.8.43 <4.8.43.4>=4.8.50 <4.8.50.1>=4.8.50 <4.8.50.3

WSO2

WSO2 Carbon Registry Search UI

Affected versions
>=4.7.24 <4.7.24.11>=4.7.32 <4.7.32.16>=4.7.32 <4.7.32.18>=4.7.33 <4.7.33.16>=4.7.35 <4.7.35.15>=4.7.39 <4.7.39.12>=4.7.51 <4.7.51.8>=4.8.3 <4.8.3.10>=4.8.9 <4.8.9.16>=4.8.12 <4.8.12.8>=4.8.13 <4.8.13.9>=4.8.24 <4.8.24.6

WSO2

WSO2 Stratos User Interface For Tenant CRUD Operations

Affected versions
>=4.8.1 <4.8.1.6>=4.8.7 <4.8.7.3>=4.9.8 <4.9.8.7>=4.9.10 <4.9.10.7>=4.9.10 <4.9.10.8>=4.9.20 <4.9.20.5>=4.9.27 <4.9.27.1>=4.9.31 <4.9.31.1>=4.9.34 <4.9.34.1>=4.9.42 <4.9.42.1>=4.11.0 <4.11.0.7>=4.11.19 <4.11.19.4>=4.11.34 <4.11.34.3>=4.11.45 <4.11.45.1

WSO2

WSO2 Stratos SSO Redirector UI Component

Affected versions
>=4.8.1 <4.8.1.6

WSO2

WSO2 Carbon Email Verification UI

Affected versions
>=4.7.19 <4.7.19.14

WSO2

WSO2 Carbon Event Simulator UI

Affected versions
>=2.2.11 <2.2.11.1>=2.2.14 <2.2.14.11>=2.2.14 <2.2.14.12>=2.2.17 <2.2.17.5>=2.3.1 <2.3.1.4>=2.3.5 <2.3.5.6

WSO2

WSO2 Carbon Execution Manager UI

Affected versions
>=5.2.24 <5.2.24.10>=5.2.26 <5.2.26.22>=5.2.34 <5.2.34.12>=5.2.41 <5.2.41.7>=5.2.57 <5.2.57.10>=5.3.5 <5.3.5.9

WSO2

WSO2 Carbon Governance Custom Lifecycle Checklist UI

Affected versions
>=4.8.14 <4.8.14.4>=4.8.19 <4.8.19.8>=4.8.21 <4.8.21.10>=4.8.28 <4.8.28.4>=4.8.30 <4.8.30.6>=4.8.32 <4.8.32.4

WSO2

WSO2 Carbon Governance Generic Artifact User Interface

Affected versions
>=4.8.14 <4.8.14.4>=4.8.19 <4.8.19.8>=4.8.21 <4.8.21.10>=4.8.28 <4.8.28.4>=4.8.30 <4.8.30.6>=4.8.32 <4.8.32.4>=4.8.33 <4.8.33.4>=4.8.34 <4.8.34.5>=4.8.37 <4.8.37.4

WSO2

WSO2 Carbon Governance Life Cycles User Interface

Affected versions
>=4.8.14 <4.8.14.4>=4.8.19 <4.8.19.8>=4.8.21 <4.8.21.10>=4.8.28 <4.8.28.4>=4.8.30 <4.8.30.6>=4.8.32 <4.8.32.4

WSO2

WSO2 Carbon Governance WSDL Tool UI

Affected versions
>=4.8.14 <4.8.14.4>=4.8.19 <4.8.19.8>=4.8.21 <4.8.21.10>=4.8.28 <4.8.28.4>=4.8.30 <4.8.30.6>=4.8.32 <4.8.32.4>=4.8.33 <4.8.33.4>=4.8.34 <4.8.34.5>=4.8.37 <4.8.37.4

WSO2

WSO2 Carbon New Data Sources UI

Affected versions
>=4.7.19 <4.7.19.13>=4.7.24 <4.7.24.5>=4.7.32 <4.7.32.10>=4.7.35 <4.7.35.13>=4.7.49 <4.7.49.7>=4.7.52 <4.7.52.5>=4.9.2 <4.9.2.8>=4.9.11 <4.9.11.2>=4.9.18 <4.9.18.1

WSO2

WSO2 Carbon Registry Info UI2

Affected versions
>=4.7.32 <4.7.32.16>=4.7.35 <4.7.35.15>=4.7.39 <4.7.39.12>=4.7.51 <4.7.51.8>=4.8.3 <4.8.3.10>=4.8.13 <4.8.13.9>=4.8.32 <4.8.32.4>=4.8.36 <4.8.36.2>=4.8.43 <4.8.43.2>=4.8.50 <4.8.50.1

WSO2

WSO2 Carbon Registry Relations UI

Affected versions
>=4.7.24 <4.7.24.11>=4.7.32 <4.7.32.16>=4.7.35 <4.7.35.15>=4.7.39 <4.7.39.12>=4.7.51 <4.7.51.8>=4.8.3 <4.8.3.10>=4.8.13 <4.8.13.9>=4.8.32 <4.8.32.4>=4.8.36 <4.8.36.2>=4.8.43 <4.8.43.2>=4.8.50 <4.8.50.1

WSO2

WSO2 Carbon Registry Indexing

Affected versions
>=4.7 <4.7.24

WSO2

WSO2 Carbon Security UI

Affected versions
>=5.14 <5.14.127

WSO2

WSO2 Carbon Component Andes Event UI

Affected versions
>=3.3.12 <3.3.12.3

WSO2

WSO2 Carbon Component Andes UI1

Affected versions
>=3.3.12 <3.3.12.3

WSO2

WSO2 Carbon HL7 Business Messaging Store UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Endpoint Editor UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Publish Event Mediator Configuration UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Eventing UI

Affected versions
>=4.7.19 <4.7.19.13

WSO2

WSO2 Carbon HumanTask UI

Affected versions
>=4.5.27 <4.5.27.10

WSO2

WSO2 Carbon Logging UI

Affected versions
>=4.7.19 <4.7.19.13>=4.7.24 <4.7.24.5>=4.7.32 <4.7.32.10>=4.7.52 <4.7.52.5

WSO2

WSO2 Carbon Template Editor UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Command Mediator UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Rule Mediator UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Throttle Mediator UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Tasks Core

Affected versions
>=4.7.19 <4.7.19.13

WSO2

WSO2 Carbon Rest API Admin UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Sequence Editor UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Task UI

Affected versions
>=4.7.30 <4.7.30.53

WSO2

WSO2 Carbon Governance

Affected versions
>=4.8.37 <4.8.37.4
Mavenmore threats →ai
org.wso2.identity.server/wso2-identity-server
pkg:maven/org.wso2.identity.server/wso2-identity-server
Affected versions
=5.10.0=5.11.0=6.0.0=6.1.0=7.0.0=7.1.0=7.2.0

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/13/2026, 17:33:09 UTC

Technical Analysis

The Ajax processor in the Carbon console of WSO2 Identity Server does not adequately protect state-changing operations from CSRF attacks. It uses HTTP GET requests for these operations and relies on the SameSite=Lax cookie attribute, which permits cookies to be sent with cross-origin top-level navigation GET requests. This design flaw allows attackers to cause authenticated users' browsers to execute unintended state-altering requests without their consent. The vulnerability affects multiple specific versions of WSO2 Identity Server. There is no official remediation or patch currently documented, and the vulnerability is only exploitable if the affected services are exposed to the public internet.

Potential Impact

An attacker can perform unauthorized state-changing actions on behalf of authenticated users, potentially leading to data modification, account changes, or loss of user control. The vulnerability does not impact confidentiality but affects integrity and availability due to unauthorized changes and possible service disruption. Exploitation requires user interaction and public exposure of the Carbon console, limiting the attack surface.

Mitigation Recommendations

No official patch or fix is currently documented. WSO2 recommends not exposing the Carbon console and related services to the public internet, which effectively mitigates the risk. Organizations should follow this guidance to prevent exploitation. Monitor vendor advisories for any future updates or patches addressing this vulnerability.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
WSO2
Date Reserved
2025-11-19T06:17:35.259Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6a7441c2bf8831d53967ebb2

Added to database: 08/06/2026, 08:11:46 UTC

Last enriched: 08/13/2026, 17:33:09 UTC

Last updated: 09/21/2026, 22:01:28 UTC

Views: 50

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses