What’s Vulnerable › Products

WSO2 Identity Server as Key Manager vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your WSO2 Identity Server as Key Manager version is affected

Latest WSO2 Identity Server as Key Manager vulnerabilities

• CVE-2024-2323 — Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.8)
• CVE-2025-13173 — Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
• CVE-2025-10149 — Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover (CVSS 8.2)
• CVE-2024-4412 — Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7)
• CVE-2024-4457 — Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1)
• CVE-2025-5802 — Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)