WSO2 WSO2 API Manager vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 202529
3. 202660

Known exploitedNewest addition to KEV first

• CVE-2026-5430

  Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

  WSO2 · WSO2 Universal Gateway

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-4052

  Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

  WSO2 · WSO2 API Manager

  Critical9.8
• CVE-2025-5769

  Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

  WSO2 · WSO2 API Control Plane

  Medium6.1
• CVE-2025-1397

  Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

  WSO2 · WSO2 Universal Gateway

  Medium4.8
• CVE-2024-12139

  Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

  WSO2 · WSO2 API Manager

  Medium4.3
• CVE-2024-9517

  Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

  WSO2 · WSO2 API Manager

  Medium4.9
• CVE-2024-2372

  Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

  WSO2 · WSO2 Open Banking AM

  Medium5.4
• CVE-2025-12544

  Stored Cross-Site Scripting in Multiple WSO2 Products

  WSO2 · WSO2 API Manager

  Medium4.8
• CVE-2026-2613

  SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

  WSO2 · WSO2 API Manager

  High8.7
• CVE-2026-18800

  Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

  WSO2 · WSO2 API Manager

  Medium4.4
• CVE-2024-7075

  Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products

  WSO2 · WSO2 Enterprise Integrator

  Medium4.6