Identity server
This hub aggregates every CVE we track for Identity server, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.
72
CVEs tracked
6
Critical
13
High
1
In CISA KEV
Severity distribution
MEDIUM50HIGH13CRITICAL6LOW3
Monthly trend
0
0
0
0
0
1
0
0
6
5
0
0
6
4
7
0
0
2
0
4
4
0
3
2
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Identity server.
- CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure4.0
- CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks5.9
- CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification6.1
- CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation4.8
- CVE-2025-13475Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure3.5
- CVE-2025-10470Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability8.6
- CVE-2025-9973Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover6.4
- CVE-2025-10908Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access7.3
- CVE-2024-0391Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery5.3
- CVE-2025-10503Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server6.1
- CVE-2025-12624Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock6.0
- CVE-2025-6024Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites6.1
- CVE-2024-2374XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service7.5
- CVE-2024-1524A local user can be impersonated when using federated authentication with Silent JIT Provisioning.7.7
- CVE-2025-12107Potential authenticated Server-Side Template Injection (SSTI) vulnerability.8.4
Product normalization is registry-driven with AI assist and human review. How it works