WI
Product
WSO2 Identity Server
73
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Severity mix
Critical 7High 14Medium 44Low 7
Watch
Add WSO2 Identity Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14779 | 3.8 | Aug 6 | Improper Access Control via Secret Type Management API in WSO2 Identity Server Affected: 6.0.0 before 6.0.0.261; 6.1.0 before 6.1.0.262; 7.1.0 before 7.1.0.46 |
| CVE-2025-0672 | 3.8 | Sep 23 | Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association Affected: 5.10.0 before 5.10.0.345; 5.11.0 before 5.11.0.394 |
| CVE-2025-13166 | 3.7 | Sep 15 | Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery Affected: 7.1.0 before 7.1.0.40; 7.2.0 before 7.2.0.2 |
| CVE-2025-13736 | 3.7 | Aug 6 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.380; 5.11.0 before 5.11.0.427; 6.0.0 before 6.0.0.254; 6.1.0 before 6.1.0.255; 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40; +1 more |
| CVE-2026-3583 New | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] Affected: 5.10.0 before 5.10.0.397; 5.11.0 before 5.11.0.444; 6.0.0 before 6.0.0.270; 6.1.0 before 6.1.0.269; 7.0.0 before 7.0.0.152; 7.1.0 before 7.1.0.61; +2 more |
| CVE-2024-4412 | 2.7 | Oct 19 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations Affected: 5.10.0 before 5.10.0.297; 5.11.0 before 5.11.0.337; 6.0.0 before 6.0.0.189; 6.1.0 before 6.1.0.149; 7.0.0 before 7.0.0.15 |
| CVE-2025-12627 | 2.4 | Aug 6 | Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions Affected: 7.0.0 before 7.0.0.130; 7.1.0 before 7.1.0.38 |
Showing 7