WI
Product
WSO2 Identity Server
74
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Severity mix
Critical 7High 14Medium 45Low 7
Watch
Add WSO2 Identity Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-8008 | 5.2 | Jun 2 | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation Affected: 5.10.0 before 5.10.0.328; 5.11.0 before 5.11.0.374; 6.0.0 before 6.0.0.216; 6.1.0 before 6.1.0.201; 7.0.0 before 7.0.0.69 |
| CVE-2025-12317 | 5.0 | Aug 6 | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges Affected: 5.11.0 before 5.11.0.423 |
| CVE-2025-7203 | 4.9 | Oct 19 | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials Affected: 7.0.0 before 7.0.0.111; 7.1.0 before 7.1.0.19 |
| CVE-2024-8995 | 4.9 | Aug 6 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Affected: 5.10.0 before 5.10.0.345; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.229; 6.1.0 before 6.1.0.208 |
| CVE-2024-5563 | 4.8 | Oct 21 | Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks Affected: 7.0.0 before 7.0.0.37 |
| CVE-2024-2323 | 4.8 | Oct 20 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.286; 5.11.0 before 5.11.0.344; 6.0.0 before 6.0.0.188; 6.1.0 before 6.1.0.150; 7.0.0 before 7.0.0.35 |
| CVE-2025-5350 | 4.8 | Oct 24 | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products Affected: 5.10.0 before 5.10.0.359; 5.11.0 before 5.11.0.415; 6.0.0 before 6.0.0.246; 6.1.0 before 6.1.0.245; 7.0.0 before 7.0.0.120; 7.1.0 before 7.1.0.27 |
| CVE-2026-0637 | 4.4 | Aug 6 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Affected: 5.10.0 before 5.10.0.386; 5.11.0 before 5.11.0.433; 6.0.0 before 6.0.0.260; 6.1.0 before 6.1.0.261; 7.0.0 before 7.0.0.139; 7.1.0 before 7.1.0.47; +1 more |
| CVE-2025-13909 | 4.3 | Aug 6 | Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42 |
| CVE-2025-11850 | 4.3 | Aug 6 | Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use] Affected: 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40 |
| CVE-2024-0391 | 4.3 | May 11 | Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.379; 5.11.0 before 5.11.0.426; 5.11.0 before 5.11.0.431; 6.0.0 before 6.0.0.253; 6.1.0 before 6.1.0.254; 7.0.0 before 7.0.0.131 |
| CVE-2024-6429 | 4.3 | Sep 23 | Content Spoofing in Multiple WSO2 Products via Error Message Injection Affected: 5.10.0 before 5.10.0.314; 5.11.0 before 5.11.0.359; 6.0.0 before 6.0.0.203; 6.1.0 before 6.1.0.176; 7.0.0 before 7.0.0.48 |
| CVE-2024-3511 | 4.3 | Jun 23 | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files Affected: 5.10.0 before 5.10.0.292; 5.11.0 before 5.11.0.333; 6.0.0 before 6.0.0.180; 6.1.0 before 6.1.0.141; 7.0.0 before 7.0.0.8 |
| CVE-2024-3509 | 4.3 | Jun 2 | Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor Affected: 5.10.0 before 5.10.0.296; 5.11.0 before 5.11.0.333; 6.0.0 before 6.0.0.181; 6.1.0 before 6.1.0.142; 7.0.0 before 7.0.0.9 |
| CVE-2024-7097 | 4.3 | May 30 | Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup Affected: 5.2.0 before 5.2.0.32; 5.3.0 before 5.3.0.33; 5.4.0 before 5.4.0.32; 5.4.1 before 5.4.1.36; 5.5.0 before 5.5.0.50; 5.6.0 before 5.6.0.58; +8 more |
| CVE-2024-6423 | 4.0 | Oct 21 | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage Affected: 5.10.0 before 5.10.0.337; 5.11.0 before 5.11.0.384; 6.0.0 before 6.0.0.213; 6.1.0 before 6.1.0.211; 7.0.0 before 7.0.0.50 |
| CVE-2025-14779 | 3.8 | Aug 6 | Improper Access Control via Secret Type Management API in WSO2 Identity Server Affected: 6.0.0 before 6.0.0.261; 6.1.0 before 6.1.0.262; 7.1.0 before 7.1.0.46 |
| CVE-2025-0672 | 3.8 | Sep 23 | Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association Affected: 5.10.0 before 5.10.0.345; 5.11.0 before 5.11.0.394 |
| CVE-2025-13166 | 3.7 | Sep 15 | Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery Affected: 7.1.0 before 7.1.0.40; 7.2.0 before 7.2.0.2 |
| CVE-2025-13736 | 3.7 | Aug 6 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery Affected: 5.10.0 before 5.10.0.380; 5.11.0 before 5.11.0.427; 6.0.0 before 6.0.0.254; 6.1.0 before 6.1.0.255; 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40; +1 more |
| CVE-2026-3583 New | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] Affected: 5.10.0 before 5.10.0.397; 5.11.0 before 5.11.0.444; 6.0.0 before 6.0.0.270; 6.1.0 before 6.1.0.269; 7.0.0 before 7.0.0.152; 7.1.0 before 7.1.0.61; +2 more |
| CVE-2024-4412 | 2.7 | Oct 19 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations Affected: 5.10.0 before 5.10.0.297; 5.11.0 before 5.11.0.337; 6.0.0 before 6.0.0.189; 6.1.0 before 6.1.0.149; 7.0.0 before 7.0.0.15 |
| CVE-2025-12627 | 2.4 | Aug 6 | Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions Affected: 7.0.0 before 7.0.0.130; 7.1.0 before 7.1.0.38 |
| CVE-2025-0326 | – | Oct 21 | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access Affected: 7.0.0 before 7.0.0.85 |