CVE-2025-5605: WSO2 Identity Server · CWE-290
Affects WSO2 Identity ServerSource CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Oct 2025
Detectable: evidence found.
nuclei template: WSO2 Management Console - Authentication Bypass
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.wso2.identityserver/wso2-identity-serverpkg:maven/org.wso2.identityserver/wso2-identity-serverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-5605, European organizations should implement the following specific measures: 1) Restrict network access to the WSO2 Management Console strictly to trusted administrators via network segmentation, VPNs, or IP whitelisting to prevent unauthorized access from adjacent networks. 2) Monitor and log all access attempts to the management console to detect unusual or unauthorized URI manipulation patterns. 3) Apply the latest patches or updates from WSO2 as soon as they become available, as the vendor is likely to release a fix given the vulnerability's publication. 4) Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious request URIs targeting the management console. 5) Conduct regular security assessments and penetration tests focusing on identity management infrastructure to identify and remediate similar weaknesses. 6) Educate administrators on secure management console usage and the risks of exposing such interfaces. 7) Consider deploying multi-factor authentication (MFA) and enhanced logging around management console access, even though this vulnerability bypasses authentication, to improve detection and response capabilities.
Description
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.