Login Request a demo
WI
Product
WSO2 Identity Server
by WSO2 · last CVE Oct 28, 2026
74
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Vulnerabilities74In the news0Timeline
Severity mix
Critical 7High 14Medium 45Low 7
Severity
All severities74Critical7High14Medium45Low7
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WSO2 Identity Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-0663
6.8
0%
Sep 23
Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
Affected: 5.10.0 before 5.10.0.343; 5.11.0 before 5.11.0.392; 6.0.0 before 6.0.0.228; 6.1.0 before 6.1.0.220; 7.0.0 before 7.0.0.88
CVE-2025-13173
6.5
0%
Oct 19
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 5.2.0 before 5.2.0.34; 5.3.0 before 5.3.0.36; 5.4.0 before 5.4.0.34; 5.4.1 before 5.4.1.38; 5.5.0 before 5.5.0.52; 5.6.0 before 5.6.0.60; +9 more
CVE-2024-7073
6.5
0%
Jun 2
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
Affected: 5.2.0 before 5.2.0.32; 5.3.0 before 5.3.0.32; 5.4.0 before 5.4.0.31; 5.4.1 before 5.4.1.36; 5.5.0 before 5.5.0.49; 5.6.0 before 5.6.0.57; +8 more
CVE-2026-11854
New
6.1–Oct 28
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
Affected: 5.10.0 before 5.10.0.399; 5.11.0 before 5.11.0.446; 6.0.0 before 6.0.0.272; 6.1.0 before 6.1.0.274; 7.0.0 before 7.0.0.155; 7.1.0 before 7.1.0.65; +1 more
CVE-2024-5139
6.1
0%
Oct 21
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
Affected: 5.10.0 before 5.10.0.310; 6.0.0 before 6.0.0.212; 6.1.0 before 6.1.0.195; 7.0.0 before 7.0.0.64
CVE-2026-2445
6.1
0%
Jul 20
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
Affected: 6.0.0 before 6.0.0.263; 6.1.0 before 6.1.0.266; 7.0.0 before 7.0.0.144; 7.1.0 before 7.1.0.53; 7.2.0 before 7.2.0.12
CVE-2025-8591
6.1
0%
Jul 6
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Affected: 5.10.0 before 5.10.0.381; 5.10.0 before 5.10.0.384; 6.0.0 before 6.0.0.255; 7.0.0 before 7.0.0.131; 7.1.0 before 7.1.0.21; 7.1.0 before 7.1.0.51
CVE-2025-10503
6.1
0%
Apr 29
Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
Affected: 7.1.0 before 7.1.0.28
CVE-2025-6024
6.1
0%
Apr 16
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
Affected: 5.10.0 before 5.10.0.360; 5.11.0 before 5.11.0.405
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 5.10.0 before 5.10.0.373; 5.11.0 before 5.11.0.417; 6.0.0 before 6.0.0.247; 6.1.0 before 6.1.0.246; 7.0.0 before 7.0.0.122; 7.1.0 before 7.1.0.29
CVE-2025-5770
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Affected: 6.0.0 before 6.0.0.247; 6.1.0 before 6.1.0.246; 7.0.0 before 7.0.0.122; 7.1.0 before 7.1.0.29
CVE-2025-0209
6.1
0%
Sep 23
Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow
Affected: 7.0.0 before 7.0.0.87
CVE-2024-1440
6.1
0%
Jun 2
Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
Affected: 5.10.0 before 5.10.0.278; 5.11.0 before 5.11.0.347; 6.0.0 before 6.0.0.185; 6.1.0 before 6.1.0.145; 7.0.0 before 7.0.0.30
CVE-2024-5962
6.1
0%
May 22
Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding
Affected: 6.0.0 before 6.0.0.199; 6.1.0 before 6.1.0.172
CVE-2024-8122
5.9
0%
Oct 8
Potential brute force vulnerability due to non-expiring SMS OTPs
Affected: 5.11.0 before 5.11.0.372; 6.0.0 before 6.0.0.227; 6.1.0 before 6.1.0.219
CVE-2024-7478
5.8
0%
Oct 21
Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.326; 6.0.0 before 6.0.0.214; 6.1.0 before 6.1.0.198; 7.0.0 before 7.0.0.67
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 5.10.0 before 5.10.0.358; 5.11.0 before 5.11.0.379
CVE-2024-7487
5.8
0%
May 22
Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
Affected: 7.0.0 before 7.0.0.65
CVE-2024-2321
5.6
0%
Feb 27
Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token
Affected: 5.11.0 before 5.11.0.326; 6.0.0 before 6.0.0.172; 6.1.0 before 6.1.0.130
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 5.10.0 before 5.10.0.381; 5.11.0 before 5.11.0.428; 6.0.0 before 6.0.0.255; 6.1.0 before 6.1.0.256; 7.0.0 before 7.0.0.133; 7.1.0 before 7.1.0.41; +1 more
CVE-2025-12624
5.4
0%
Apr 16
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
Affected: 5.2.0 before 5.2.0.35
CVE-2024-7096
5.4
1%
May 30
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
Affected: 5.2.0 before 5.2.0.32; 5.3.0 before 5.3.0.33; 5.4.1 before 5.4.1.36; 5.5.0 before 5.5.0.50; 5.6.0 before 5.6.0.58; 5.7.0 before 5.7.0.123; +7 more
CVE-2024-7103
5.4
0%
May 22
Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow
Affected: 7.0.0 before 7.0.0.64
CVE-2025-13591
5.3
0%
Oct 19
Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42
CVE-2025-5802
5.3
0%
Sep 15
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.383; 5.11.0 before 5.11.0.430; 6.0.0 before 6.0.0.257; 6.1.0 before 6.1.0.234; 6.1.0 before 6.1.0.257; 7.0.0 before 7.0.0.133; +2 more
CVE-2024-1248
5.3
0%
Jul 4
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Affected: 5.8.0 before 5.8.0.101; 5.9.0 before 5.9.0.138; 5.10.0 before 5.10.0.284; 5.11.0 before 5.11.0.321
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 5.10.0 before 5.10.0.361; 5.11.0 before 5.11.0.414; 6.0.0 before 6.0.0.245; 6.1.0 before 6.1.0.244; 7.0.0 before 7.0.0.119; 7.1.0 before 7.1.0.25
CVE-2025-1396
5.3
0%
Sep 26
Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled
Affected: 5.10.0 before 5.10.0.346; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.231; 6.1.0 before 6.1.0.223
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 5.10.0 before 5.10.0.328; 5.11.0 before 5.11.0.374; 6.0.0 before 6.0.0.216; 6.1.0 before 6.1.0.201; 7.0.0 before 7.0.0.69
CVE-2025-12317
5.0
0%
Aug 6
Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
Affected: 5.11.0 before 5.11.0.423
CVE-2025-7203
4.9
0%
Oct 19
Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
Affected: 7.0.0 before 7.0.0.111; 7.1.0 before 7.1.0.19
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 5.10.0 before 5.10.0.345; 5.11.0 before 5.11.0.395; 6.0.0 before 6.0.0.229; 6.1.0 before 6.1.0.208
CVE-2024-5563
4.8
0%
Oct 21
Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
Affected: 7.0.0 before 7.0.0.37
CVE-2024-2323
4.8
0%
Oct 20
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.286; 5.11.0 before 5.11.0.344; 6.0.0 before 6.0.0.188; 6.1.0 before 6.1.0.150; 7.0.0 before 7.0.0.35
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 5.10.0 before 5.10.0.359; 5.11.0 before 5.11.0.415; 6.0.0 before 6.0.0.246; 6.1.0 before 6.1.0.245; 7.0.0 before 7.0.0.120; 7.1.0 before 7.1.0.27
CVE-2026-0637
4.4
0%
Aug 6
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Affected: 5.10.0 before 5.10.0.386; 5.11.0 before 5.11.0.433; 6.0.0 before 6.0.0.260; 6.1.0 before 6.1.0.261; 7.0.0 before 7.0.0.139; 7.1.0 before 7.1.0.47; +1 more
CVE-2025-13909
4.3
0%
Aug 6
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
Affected: 7.0.0 before 7.0.0.134; 7.1.0 before 7.1.0.42
CVE-2025-11850
4.3
0%
Aug 6
Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
Affected: 7.0.0 before 7.0.0.132; 7.1.0 before 7.1.0.40
CVE-2024-0391
4.3
0%
May 11
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 5.10.0 before 5.10.0.379; 5.11.0 before 5.11.0.426; 5.11.0 before 5.11.0.431; 6.0.0 before 6.0.0.253; 6.1.0 before 6.1.0.254; 7.0.0 before 7.0.0.131
CVE-2024-6429
4.3
0%
Sep 23
Content Spoofing in Multiple WSO2 Products via Error Message Injection
Affected: 5.10.0 before 5.10.0.314; 5.11.0 before 5.11.0.359; 6.0.0 before 6.0.0.203; 6.1.0 before 6.1.0.176; 7.0.0 before 7.0.0.48
CVE-2024-3511
4.3
0%
Jun 23
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
Affected: 5.10.0 before 5.10.0.292; 5.11.0 before 5.11.0.333; 6.0.0 before 6.0.0.180; 6.1.0 before 6.1.0.141; 7.0.0 before 7.0.0.8
CVE-2024-3509
4.3
0%
Jun 2
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
Affected: 5.10.0 before 5.10.0.296; 5.11.0 before 5.11.0.333; 6.0.0 before 6.0.0.181; 6.1.0 before 6.1.0.142; 7.0.0 before 7.0.0.9
CVE-2024-7097
4.3
1%
May 30
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
Affected: 5.2.0 before 5.2.0.32; 5.3.0 before 5.3.0.33; 5.4.0 before 5.4.0.32; 5.4.1 before 5.4.1.36; 5.5.0 before 5.5.0.50; 5.6.0 before 5.6.0.58; +8 more
CVE-2024-6423
4.0
0%
Oct 21
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
Affected: 5.10.0 before 5.10.0.337; 5.11.0 before 5.11.0.384; 6.0.0 before 6.0.0.213; 6.1.0 before 6.1.0.211; 7.0.0 before 7.0.0.50
Showing 45