Login Request a demo
IS
Product
Identity Server
by Wso2 · last CVE Sep 3, 2026
On CISA KEVExploited in the wildRansomware-linked
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities83In the news0Timeline
Severity mix
Critical 8High 19Medium 52Low 4
Severity
All severities83Critical8High19Medium52Low4
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Identity Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-0663
6.8
0%
Sep 23
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2025-9804
6.5
1%
Oct 16
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs
Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +9 more
CVE-2024-7073
6.5
0%
Jun 2
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services
Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +8 more
CVE-2026-2445
6.1
0%
Jul 20
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
Affected: 6.0.0 before 6.0.0.263; 6.1.0 before 6.1.0.266; 7.0.0 before 7.0.0.144; 7.1.0 before 7.1.0.53; 7.2.0 before 7.2.0.12
CVE-2025-8591
6.1
0%
Jul 6
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Affected: 5.10.0 before 5.10.0.384; 6.0.0 before 6.0.0.255; 7.0.0 before 7.0.0.131; 7.1.0 before 7.1.0.51
CVE-2025-10503
6.1
0%
Apr 29
Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
Affected: 7.1.0 before 7.1.0.28
CVE-2025-6024
6.1
0%
Apr 16
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
Affected: 5.10.0; 5.11.0
CVE-2025-10853
6.1
0%
Nov 5
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2025-5770
6.1
0%
Nov 5
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding
Affected: 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2025-0209
6.1
0%
Sep 23
A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding
Affected: 7.0.0
CVE-2024-1440
6.1
0%
Jun 2
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option…
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-5962
6.1
0%
May 22
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input
Affected: 6.0.0; 6.1.0
CVE-2023-6838
6.1
0%
Dec 15
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint
Affected: 5.10.0
CVE-2022-29548
6.1
41%
Apr 21
A reflected XSS issue exists in the Management Console of several WSO2 products
Affected: 5.5.0; 5.6.0; 5.7.0; 5.9.0; 5.10.0; 5.11.0
CVE-2021-36760
6.1
1%
Dec 7
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL…
Affected: 5.7.0; 5.8.0; 5.9.0; 5.10.0; 5.11.0
CVE-2020-17453
6.1
26%
Apr 5
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter
Affected: through 5.10.0
CVE-2020-24706
6.1
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: through 5.10.0
CVE-2020-24704
6.1
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: 5.5.0; 5.8.0
CVE-2020-14446
6.1
1%
Jun 18
An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0
Affected: through 5.10.0
CVE-2019-20437
6.1
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2019-20436
6.1
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2019-18882
6.1
1%
Nov 12
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled
Affected: 5.7.0
CVE-2019-18881
6.1
1%
Nov 12
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile
Affected: 5.7.0
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 5.10.0; 5.11.0
CVE-2024-7487
5.8
0%
May 22
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid…
Affected: 7.0.0
CVE-2024-2321
5.6
0%
Feb 27
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access…
Affected: 5.11.0; 6.0.0; 6.1.0
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more
CVE-2025-12624
5.4
0%
Apr 16
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
Affected: 5.2.0
CVE-2024-7096
5.4
1%
May 30
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services
Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +8 more
CVE-2024-7103
5.4
0%
May 22
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation
Affected: 7.0.0
CVE-2020-14445
5.4
1%
Jun 18
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0
Affected: through 5.9.0
CVE-2020-14444
5.4
1%
Jun 18
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0
Affected: through 5.9.0
CVE-2018-20737
5.4
1%
Mar 18
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0
Affected: 5.7.0
CVE-2018-8716
5.4
38%
Apr 25
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers
Affected: before 5.5.0
CVE-2024-1248
5.3
0%
Jul 4
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Affected: 5.8.0 before 5.8.0.101; 5.9.0 before 5.9.0.138; 5.10.0 before 5.10.0.284; 5.11.0 before 5.11.0.321
CVE-2025-5605
5.3
1%
Oct 24
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2025-1396
5.3
0%
Sep 26
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 5.10.0 before 5.10.0.338; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.229; 6.1.0 before 6.1.0.208
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0
CVE-2023-6911
4.8
0%
Dec 18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a…
Affected: 5.4.0; 5.4.1; 5.5.0; 5.6.0; 5.7.0; 5.8.0; +2 more
CVE-2019-20443
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2019-20442
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 5.7.0; 5.8.0
CVE-2017-14651
4.8
4%
Sep 21
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter
Affected: 5.3.0
CVE-2026-0637
4.4
0%
Aug 6
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Affected: 5.10.0 before 5.10.0.386; 5.11.0 before 5.11.0.433; 6.0.0 before 6.0.0.260; 6.1.0 before 6.1.0.261
CVE-2025-13909
4.3
0%
Aug 6
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42
CVE-2025-11850
4.3
0%
Aug 6
Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
Affected: 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40
CVE-2024-0391
4.3
0%
May 11
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.379; 5.11.0 before 5.11.0.426; 6.0.0 before 6.0.0.253; 6.1.0 before 6.1.0.254; 7.0.0 before 7.0.0.131
CVE-2024-6429
4.3
0%
Sep 23
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
CVE-2024-3511
4.3
0%
Jun 23
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry
Affected: 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0
Page 1 of 2 · 52 total
12