What’s Vulnerable › Products

WSO2 Identity Server vulnerabilities

99 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 70 published in the last 12 months.

Check whether your WSO2 Identity Server version is affected

Exploited WSO2 Identity Server vulnerabilities

• CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Latest WSO2 Identity Server vulnerabilities

• CVE-2025-0326 — Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
• CVE-2024-7478 — Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.8)
• CVE-2024-6423 — Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (CVSS 4.0)
• CVE-2024-5563 — Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks (CVSS 4.8)
• CVE-2024-5139 — Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
• CVE-2024-2323 — Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.8)
• CVE-2025-7203 — Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9)
• CVE-2025-13591 — Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery (CVSS 5.3)
• CVE-2025-13173 — Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
• CVE-2025-10149 — Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover (CVSS 8.2)
• CVE-2024-4412 — Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7)
• CVE-2024-4457 — Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1)
• CVE-2024-8122 — Potential brute force vulnerability due to non-expiring SMS OTPs (CVSS 5.9)
• CVE-2025-5802 — Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
• CVE-2025-13166 — Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery (CVSS 3.7)
• CVE-2025-12737 — Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
• CVE-2025-12317 — Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges (CVSS 5.0)
• CVE-2026-0637 — Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (CVSS 4.4)
• CVE-2025-15039 — Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
• CVE-2025-14779 — Improper Access Control via Secret Type Management API in WSO2 Identity Server (CVSS 3.8)
• CVE-2025-13909 — Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure (CVSS 4.3)
• CVE-2025-13736 — Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery (CVSS 3.7)
• CVE-2025-13394 — Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
• CVE-2025-12627 — Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions (CVSS 2.4)
• CVE-2025-11850 — Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use] (CVSS 4.3)