Medium severity · published May 22, 2025
CVE-2024-7487
Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
5.8
CVSS
0.3%
EPSS
No
On KEV
Description
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed.
Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Client Attestation Filter · WSO2
7.0.26 before 7.0.26.24 · source: vendor
WC
WSO2 Carbon Identity Client Attestation Met Data Mgt BE · WSO2
7.0.78 before 7.0.78.44 · source: vendor
WI
WSO2 Identity Server · WSO2
7.0.0 before 7.0.0.65 · source: vendor
IS
Identity Server · Wso2
7.0.0 · source: NVD