WSO2 vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20236
3. 202619
4. 202661
5. 202643

Known exploitedNewest addition to KEV first

• CVE-2026-5430

  Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

  WSO2 · WSO2 Universal Gateway

  ExploitedCritical10.0

Newest CVEs

• CVE-2025-11229

  Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

  WSO2 · WSO2 Identity Server

  High7.2
• CVE-2026-4052

  Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

  WSO2 · WSO2 API Manager

  Critical9.8
• CVE-2025-5769

  Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

  WSO2 · WSO2 API Control Plane

  Medium6.1
• CVE-2025-1397

  Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

  WSO2 · WSO2 Universal Gateway

  Medium4.8
• CVE-2024-12139

  Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

  WSO2 · WSO2 API Manager

  Medium4.3
• CVE-2024-12141

  Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

  WSO2 · WSO2 Identity Server

  Medium4.3
• CVE-2024-9517

  Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

  WSO2 · WSO2 API Manager

  Medium4.9
• CVE-2024-2372

  Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

  WSO2 · WSO2 Open Banking AM

  Medium5.4
• CVE-2025-12544

  Stored Cross-Site Scripting in Multiple WSO2 Products

  WSO2 · WSO2 API Manager

  Medium4.8
• CVE-2026-2613

  SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

  WSO2 · WSO2 API Manager

  High8.7