By vendor

Wso2 vulnerabilities

Known CVEs affecting Wso2 products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-4249HIGH 8.6

  A weakness in how WSO2 API infrastructure products handle event throttling allows attackers to send specially crafted data that crashes or disables the API Gateway without authentication. Once triggered, the system stays down until someone manually restarts it, potentially blocking all API traffic for hours or longer.

• CVE-2026-2053HIGH 8.3

  WSO2 API Manager contains a vulnerability in how it processes WS-Addressing headers—a standard part of SOAP web service communications. The vulnerability stems from insufficient validation of user-controlled input within these headers. An unauthenticated attacker can exploit this by crafting malicious WS-Addressing headers that trick the API Manager into making requests to arbitrary destinations. This effectively turns the API Manager into a proxy for attacker-controlled network reconnaissance and access attempts, potentially exposing internal resources that should be isolated from external networks.

• CVE-2025-8591MEDIUM 6.1

  CVE-2025-8591 is a reflected cross-site scripting (XSS) vulnerability affecting multiple WSO2 products. An attacker can craft a malicious URL containing script code that, when clicked by a user, executes arbitrary JavaScript in the victim's browser. While session cookies are protected by httpOnly flags (preventing token theft), an attacker can still redirect users to phishing sites, deface page content, or harvest non-sensitive browser data. The vulnerability requires user interaction—the victim must click a crafted link—making it a social engineering vector rather than a wormable flaw.

• CVE-2024-1248MEDIUM 4.8

  A vulnerability in federated authentication systems allows an attacker to hijack and reassign user roles when a federated identity provider has silent just-in-time account provisioning enabled. If a federated user shares a username with an existing local account, the provisioning process can overwrite the local user's roles with whatever the federated system assigns. An attacker needs to know a legitimate local username and have access to a federated identity provider configured with silent JIT provisioning to execute this attack. The impact is limited to role changes (typically to minimal access levels) rather than full account takeover.

• CVE-2025-13475LOW 3.5

  CVE-2025-13475 is a consent isolation flaw in multi-tenant deployments where user consent granted for a SaaS application in one tenant can leak to applications with the same name in other tenants. This cross-tenant consent sharing allows applications to access user data without proper authorization. The issue is confined to systems running in multi-tenant mode; single-tenant deployments are unaffected.