Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.
Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.
CVE-2026-3096 is an improper input validation vulnerability in WSO2 API Control Plane web portals. It arises because external links can be opened in a new browser tab while the originating window retains access to the new page. This allows interaction between the two browser contexts, potentially enabling an attacker to manipulate the original trusted window after a user clicks a malicious external link. Such manipulation can lead to phishing redirections or unauthorized actions within the trusted site context. The vulnerability has a medium severity with a CVSS score of 4.7.
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.
Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.
Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
CVE-2025-14561 is a critical improper access control vulnerability in WSO2 API Manager affecting multi-tenant deployments. The Publisher REST APIs do not properly enforce tenant isolation, allowing a privileged user in one tenant to perform publisher operations such as exposing or modifying API metadata in other tenants. This issue impacts versions 4.1.0 through 4.6.0. The vulnerability has a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2025-12317 is a medium severity vulnerability in WSO2 Enterprise Integrator version 6.6.0 where the system does not invalidate authentication tokens after internal user roles are removed. This allows users to retain access privileges associated with revoked roles until tokens expire naturally, potentially enabling unauthorized actions or access to restricted resources.
CVE-2025-6508 is a medium severity cross-site scripting (XSS) vulnerability in the Swagger UI Try-out console of WSO2 API Manager. It allows loading an external Swagger API definition URL, which can override existing API definitions in the API Publisher portal. This can mislead users into interacting with maliciously altered API definitions, potentially exposing sensitive information or causing unintended backend requests.
CVE-2024-6541 is a medium severity vulnerability in WSO2 Micro Integrator where the Class Mediator does not properly validate or sanitize messageContext properties used for dynamic values. Authenticated users could exploit this to access or modify data across system invocations that should be isolated, potentially disclosing sensitive information or causing unintended data modification. The impact depends on the specific use of messageContext properties in the affected versions.
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.
Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
CVE-2026-1728 is a critical vulnerability in WSO2 API Manager where tokens issued to low-privileged users are not sufficiently restricted. This flaw allows these tokens to access product-level Admin REST APIs, potentially enabling an attacker with a low-privileged account to escalate privileges to full administrative control. The vulnerability affects multiple specific versions of WSO2 API Manager. No official patch or remediation guidance has been provided yet.
CVE-2025-15039 is a critical vulnerability in WSO2 Identity Server affecting multiple versions. It involves a protection mechanism failure in the Conditional Authentication (Adaptive Authentication) script, which does not properly enforce completion of all required authentication steps in certain multi-step authentication flows. This flaw allows attackers to bypass intermediate authentication challenges under specific conditions, potentially gaining unauthorized access to user accounts.
CVE-2026-0637 is a vulnerability in WSO2 API Manager where misconfigured Event Publisher output adapters log sensitive information without proper validation or sanitization. This can lead to sensitive data, such as user credentials, being stored in log files accessible to users with access to the 'wso2carbon' logs. The vulnerability has a medium severity rating with a CVSS score of 4.4.
CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax processor of the Carbon console within WSO2 Identity Server. The vulnerability arises because state-changing operations use the HTTP GET method and rely on the SameSite=Lax cookie attribute for CSRF mitigation, which can be bypassed. This allows attackers to trick authenticated users into unknowingly performing unauthorized actions. Exploitation requires the Carbon console and related services to be publicly accessible, which is against WSO2's security recommendations.
CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.
CVE-2025-12627 is a vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0 where the user impersonation flow does not properly expire refresh tokens. This allows an attacker with an access token for an impersonated user to use the refresh token to obtain new access tokens, extending unauthorized access. The flaw compromises log integrity and traceability by masking the true actor. The CVSS score is low, reflecting limited impact on confidentiality and availability but some impact on integrity.
CVE-2025-14779 is a vulnerability in WSO2 Identity Server's Secret Type Management REST API where the deletion of a secret type does not properly enforce organizational boundaries. This flaw allows the deletion cascade to remove secrets across all organizations, not just the intended one. Exploitation requires delete permissions on the Secret Type Management REST API, which are typically restricted to administrators. The vulnerability can lead to unintended secret deletions, causing configuration failures, service interruptions, and denial-of-service conditions. The CVSS score is 3.8, indicating a low severity impact.
CVE-2025-11850 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It occurs when secondary user stores are configured, causing the implicit-association resolver to incorrectly initialize from a secondary user store and bypass the primary user store during search and uniqueness checks. This can lead to identity confusion and incorrect implicit associations when using an external Identity Provider (IDP), potentially restricting legitimate user access if the secondary account has fewer privileges. Deployments without secondary user stores, with implicit association disabled, or with globally unique claim values are not affected.
CVE-2025-13736 is an information disclosure vulnerability in WSO2 Identity Server as Key Manager version 5.10.0. When Multi-Attribute Login is enabled, the login interface reveals whether a username exists by displaying the canonical username for valid users and echoing the original input for invalid users. This behavior occurs regardless of the validate_username configuration setting. The vulnerability can aid attackers in enumerating valid usernames, increasing the risk of brute force, social engineering, and phishing attacks.