IS
Product
Identity Server
On CISA KEVExploited in the wildRansomware-linked
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 19Medium 52Low 4
Watch
Add Identity Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14779 | 3.8 | Aug 6 | Improper Access Control via Secret Type Management API in WSO2 Identity Server Affected: 6.0.0 before 6.0.0.261; 6.1.0 before 6.1.0.262; 7.1.0 before 7.1.0.46 |
| CVE-2025-0672 | 3.8 | Sep 23 | An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled Affected: 5.10.0; 5.11.0 |
| CVE-2025-13736 | 3.7 | Aug 6 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.380; 5.11.0 before 5.11.0.427; 6.0.0 before 6.0.0.254; 6.1.0 before 6.1.0.255; 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40; +1 more |
| CVE-2025-12627 | 2.4 | Aug 6 | Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions Affected: 7.0.0 before 7.0.0.130; 7.1.0 before 7.1.0.38 |
Showing 4