CVE-2024-7487

published 2025-05-22

CVE-2024-7487: An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be…

Priority P4 33 medium 5.8 CVSS 3.1

AV N AC L PR N UI N S C C N I L A N

An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed.

Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
wso2	client_attestation_filter	>= 7.0.26 < 7.0.26.24	7.0.26.24
wso2	identity_server	—	—
wso2	wso2_carbon_identity_client_attestation_met_data_mgt_be	>= 7.0.78 < 7.0.78.44	7.0.78.44
wso2	wso2_identity_server	>= 7.0.0 < 7.0.0.65	7.0.0.65

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287