Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure

Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

Potential brute force vulnerability due to non-expiring SMS OTPs

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

Improper Access Control via Secret Type Management API in WSO2 Identity Server

Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access