Wso2

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or support

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these propert

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all require

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delet

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OT

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. Fo

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Reque

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary us

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This a

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not mainta

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allo

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encod

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segrega

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes be

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server al

The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or re

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/E

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient valida

Due to a lack of user account state validation during authentication, locked user accounts can be successfully authentic

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This fail

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script

The component accepts XML input through the publisher without disabling external entity resolution. This allows maliciou

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or p

The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the

When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the d

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject a