CVE-2024-10302

published 2026-08-06

CVE-2024-10302: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be…

Priority P3 35 medium 5.8 CVSS 3.1

AV N AC L PR N UI N S C C N I L A N

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes.

Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

Affected

37 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	identity_server	—	—
wso2	identity_server	—	—
wso2	identity_server_as_key_manager	—	—
wso2	open_banking_iam	—	—
wso2	traffic_manager	—	—
wso2	universal_gateway	—	—
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.10	4.5.0.10
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.331	3.1.0.331
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.427	3.2.0.427
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.39	3.2.1.39
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.318	4.0.0.318
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.200	4.1.0.200
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.138	4.2.0.138
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.51	4.3.0.51
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.9	4.5.0.9
wso2	wso2_carbon_identity_recovery_management	>= 1.4.1 < 1.4.1.72	1.4.1.72

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20