Wso2 Api Manager vulnerabilities

CVE-2026-5430 [CRITICAL] CWE-347 CVE-2026-5430: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly c The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the

CVE-2025-5605 [MEDIUM] CWE-290 CVE-2025-5605: An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics

CVE-2024-7097 [MEDIUM] CWE-863 CVE-2024-7097: An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an

CVE-2026-2053 [CRITICAL] CWE-918 CVE-2026-2053: The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not suffi The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthent

CVE-2025-9312 [CRITICAL] CWE-306 CVE-2025-9312: A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation us A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is

CVE-2025-15039 [CRITICAL] CWE-693 CVE-2025-15039: The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the compl The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and

CVE-2024-6914 [CRITICAL] CWE-863 CVE-2024-6914: An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic fl An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability

CVE-2025-9152 [CRITICAL] CWE-306 CVE-2025-9152: An improper privilege management vulnerability exists in WSO2 API Manager due to missing authenticat An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the abil

CVE-2025-10611 [CRITICAL] CWE-863 CVE-2025-10611: Due to an insufficient access control implementation in multiple WSO2 Products, authentication and a Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthentic

CVE-2026-3418 [CRITICAL] CWE-434 CVE-2026-3418: The System REST API accepts user-supplied file uploads without enforcing sufficient validation on th The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to uplo

CVE-2024-4457 [CRITICAL] CWE-78 CVE-2024-4457: The Management Console fails to properly validate input related to the configuration of JDBC user st The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server

CVE-2025-10713 [CRITICAL] CWE-611 CVE-2025-10713: An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configur An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from t

CVE-2025-8325 [HIGH] CWE-281 CVE-2025-8325: The software fails to enforce role-based access controls for certain Gateway API invocations. Users The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on

CVE-2026-1728 [CRITICAL] CWE-269 CVE-2026-1728: Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already po

CVE-2025-2905 [CRITICAL] CWE-611 CVE-2025-2905: Due to the improper configuration of XML parser, user-supplied XML is parsed without applying suffic Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (D

CVE-2024-2374 [CRITICAL] CWE-611 CVE-2024-2374: The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configu The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can rea

CVE-2026-4249 [HIGH] CWE-707 CVE-2026-4249: The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payload The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disr

CVE-2025-14561 [CRITICAL] CWE-284 CVE-2025-14561: In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. Thi In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Meta

CVE-2026-3415 [HIGH] CWE-776 CVE-2026-3415: The XML and schema validation functionalities within the SchemaValidator Mediator process XML input The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to

CVE-2024-7074 [MEDIUM] CWE-434 CVE-2024-7074: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation o An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, pote