Login Request a demo
IS
Product
Identity Server
by Wso2 · last CVE Sep 3, 2026
On CISA KEVExploited in the wildRansomware-linked
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities83In the news0Timeline
Severity mix
Critical 8High 19Medium 52Low 4
Severity
All severities83Critical8High19Medium52Low4
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Identity Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 5.10.0; 5.11.0
CVE-2024-7487
5.8
0%
May 22
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid…
Affected: 7.0.0
CVE-2024-2321
5.6
0%
Feb 27
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access…
Affected: 5.11.0; 6.0.0; 6.1.0
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more
CVE-2025-12624
5.4
0%
Apr 16
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
Affected: 5.2.0
CVE-2024-7096
5.4
1%
May 30
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services
Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +8 more
CVE-2024-7103
5.4
0%
May 22
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation
Affected: 7.0.0
CVE-2020-14445
5.4
1%
Jun 18
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0
Affected: through 5.9.0
CVE-2020-14444
5.4
1%
Jun 18
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0
Affected: through 5.9.0
CVE-2018-20737
5.4
1%
Mar 18
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0
Affected: 5.7.0
CVE-2018-8716
5.4
38%
Apr 25
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers
Affected: before 5.5.0
CVE-2024-1248
5.3
0%
Jul 4
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Affected: 5.8.0 before 5.8.0.101; 5.9.0 before 5.9.0.138; 5.10.0 before 5.10.0.284; 5.11.0 before 5.11.0.321
CVE-2025-5605
5.3
1%
Oct 24
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2025-1396
5.3
0%
Sep 26
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 5.10.0 before 5.10.0.338; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.229; 6.1.0 before 6.1.0.208
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2023-6911
4.8
0%
Dec 18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a…
Affected: 5.4.0; 5.4.1; 5.5.0; 5.6.0; 5.7.0; 5.8.0; +2 more
CVE-2019-20443
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2019-20442
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2017-14651
4.8
4%
Sep 21
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter
Affected: 5.3.0
CVE-2026-0637
4.4
0%
Aug 6
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Affected: 5.10.0 before 5.10.0.386; 5.11.0 before 5.11.0.433; 6.0.0 before 6.0.0.260; 6.1.0 before 6.1.0.261
CVE-2025-13909
4.3
0%
Aug 6
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42
CVE-2025-11850
4.3
0%
Aug 6
Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
Affected: 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40
CVE-2024-0391
4.3
0%
May 11
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.379; 5.11.0 before 5.11.0.426; 6.0.0 before 6.0.0.253; 6.1.0 before 6.1.0.254; 7.0.0 before 7.0.0.131
CVE-2024-6429
4.3
0%
Sep 23
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-3511
4.3
0%
Jun 23
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-3509
4.3
0%
Jun 2
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within…
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-7097
4.3
1%
May 30
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the…
Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +8 more
CVE-2025-14779
3.8
0%
Aug 6
Improper Access Control via Secret Type Management API in WSO2 Identity Server
Affected: 6.0.0 before 6.0.0.261; 6.1.0 before 6.1.0.262; 7.1.0 before 7.1.0.46
CVE-2025-0672
3.8
0%
Sep 23
An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled
Affected: 5.10.0; 5.11.0
CVE-2025-13736
3.7
0%
Aug 6
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.380; 5.11.0 before 5.11.0.427; 6.0.0 before 6.0.0.254; 6.1.0 before 6.1.0.255; 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40; +1 more
CVE-2025-12627
2.4
0%
Aug 6
Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
Affected: 7.0.0 before 7.0.0.130; 7.1.0 before 7.1.0.38
Page 2 of 2 · 83 total
12