WI
Product
WSO2 Identity Server
41
CVEs
0
On KEV
9.4
Max CVSS
13
New 30D
Severity mix
Critical 3High 7Medium 25Low 5
Watch
Add WSO2 Identity Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-13173 | 6.5 | Oct 19 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more |
| CVE-2024-5139 | 6.1 | Oct 21 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection Affected: 5.10.0 before 5.10.0.310; 6.0.0 before 6.0.0.212; 6.1.0 before 6.1.0.195; 7.0.0 before 7.0.0.64 |
| CVE-2026-2445 | 6.1 | Jul 20 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification Affected: 6.0.0 before 6.0.0.263; 6.1.0 before 6.1.0.266; 7.0.0 before 7.0.0.144; 7.1.0 before 7.1.0.53; 7.2.0 before 7.2.0.12 |
| CVE-2025-8591 | 6.1 | Jul 6 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification Affected: 5.10.0 before 5.10.0.381; 5.10.0 before 5.10.0.384; 6.0.0 before 6.0.0.255; 7.0.0 before 7.0.0.131; 7.1.0 before 7.1.0.21; 7.1.0 before 7.1.0.51 |
| CVE-2025-10503 | 6.1 | Apr 29 | Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server Affected: 7.1.0 before 7.1.0.28 |
| CVE-2025-6024 | 6.1 | Apr 16 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites Affected: 5.10.0 before 5.10.0.360; 5.11.0 before 5.11.0.405 |
| CVE-2024-8122 | 5.9 | Oct 8 | Potential brute force vulnerability due to non-expiring SMS OTPs Affected: 5.11.0 before 5.11.0.372; 6.0.0 before 6.0.0.227; 6.1.0 before 6.1.0.219 |
| CVE-2024-7478 New | 5.8 | Oct 21 | Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.326; 6.0.0 before 6.0.0.214; 6.1.0 before 6.1.0.198; 7.0.0 before 7.0.0.67 |
| CVE-2024-10302 | 5.8 | Aug 6 | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure Affected: 5.10.0 before 5.10.0.358; 5.11.0 before 5.11.0.379 |
| CVE-2025-13394 | 5.4 | Aug 6 | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more |
| CVE-2025-12624 | 5.4 | Apr 16 | Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock Affected: 5.2.0 before 5.2.0.35 |
| CVE-2025-13591 | 5.3 | Oct 19 | Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42 |
| CVE-2025-5802 | 5.3 | Sep 15 | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.383; 5.11.0 before 5.11.0.430; 6.0.0 before 6.0.0.257; 6.1.0 before 6.1.0.234; 6.1.0 before 6.1.0.257; 7.0.0 before 7.0.0.133; +2 more |
| CVE-2024-1248 | 5.3 | Jul 4 | Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation Affected: 5.8.0 before 5.8.0.101; 5.9.0 before 5.9.0.138; 5.10.0 before 5.10.0.284; 5.11.0 before 5.11.0.321 |
| CVE-2024-8008 | 5.2 | Jun 2 | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation Affected: 5.10.0 before 5.10.0.328; 5.11.0 before 5.11.0.374; 6.0.0 before 6.0.0.216; 6.1.0 before 6.1.0.201; 7.0.0 before 7.0.0.69 |
| CVE-2025-12317 | 5.0 | Aug 6 | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges Affected: 5.11.0 before 5.11.0.423 |
| CVE-2025-7203 | 4.9 | Oct 19 | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials Affected: 7.0.0 before 7.0.0.111; 7.1.0 before 7.1.0.19 |
| CVE-2024-8995 | 4.9 | Aug 6 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Affected: 5.10.0 before 5.10.0.345; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.229; 6.1.0 before 6.1.0.208 |
| CVE-2024-5563 | 4.8 | Oct 21 | Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks Affected: 7.0.0 before 7.0.0.37 |
| CVE-2024-2323 | 4.8 | Oct 20 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.286; 5.11.0 before 5.11.0.344; 6.0.0 before 6.0.0.188; 6.1.0 before 6.1.0.150; 7.0.0 before 7.0.0.35 |
| CVE-2026-0637 | 4.4 | Aug 6 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Affected: 5.10.0 before 5.10.0.386; 5.11.0 before 5.11.0.433; 6.0.0 before 6.0.0.260; 6.1.0 before 6.1.0.261; 7.0.0 before 7.0.0.139; 7.1.0 before 7.1.0.47; +1 more |
| CVE-2025-13909 | 4.3 | Aug 6 | Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42 |
| CVE-2025-11850 | 4.3 | Aug 6 | Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use] Affected: 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40 |
| CVE-2024-0391 | 4.3 | May 11 | Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.379; 5.11.0 before 5.11.0.426; 5.11.0 before 5.11.0.431; 6.0.0 before 6.0.0.253; 6.1.0 before 6.1.0.254; 7.0.0 before 7.0.0.131 |
| CVE-2024-6423 New | 4.0 | Oct 21 | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage Affected: 5.10.0 before 5.10.0.337; 5.11.0 before 5.11.0.384; 6.0.0 before 6.0.0.213; 6.1.0 before 6.1.0.211; 7.0.0 before 7.0.0.50 |
Showing 25