What’s Vulnerable › Products

WSO2 Identity Server As Key Manager vulnerabilities

57 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 38 published in the last 12 months.

Check whether your WSO2 Identity Server As Key Manager version is affected

Exploited WSO2 Identity Server As Key Manager vulnerabilities

• CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Latest WSO2 Identity Server As Key Manager vulnerabilities

• CVE-2026-3583 — Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] (CVSS 3.1)
• CVE-2025-14260 — Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources (CVSS 8.3)
• CVE-2024-6423 — Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (CVSS 4.0)
• CVE-2024-7478 — Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.8)
• CVE-2024-5139 — Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
• CVE-2025-12737 — Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
• CVE-2026-0637 — Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (CVSS 4.4)
• CVE-2025-15039 — Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
• CVE-2025-13736 — Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery (CVSS 3.7)
• CVE-2025-13394 — Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
• CVE-2024-8995 — Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (CVSS 4.9)
• CVE-2024-6832 — Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 7.5)
• CVE-2024-10302 — Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (CVSS 5.8)
• CVE-2025-8591 — Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1)
• CVE-2024-1248 — Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation (CVSS 5.3)
• CVE-2024-0391 — Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.3)
• CVE-2024-2374 — XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service (CVSS 9.1)
• CVE-2025-9312 — Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (CVSS 9.8)
• CVE-2025-6670 — Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (CVSS 8.8)
• CVE-2025-10853 — Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 6.1)
• CVE-2025-10907 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-3125 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-5605 — Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 5.3)
• CVE-2025-5350 — SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products (CVSS 4.8)
• CVE-2025-9804 — Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs (CVSS 6.5)