Wso2 identity server

This hub aggregates every CVE we track for Wso2 identity server, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wso2 identity server.

• CVE-2025-12317Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges5.0Aug 6, 2026
• CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products9.4Aug 6, 2026
• CVE-2026-0637Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products4.4Aug 6, 2026
• CVE-2025-13394Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions5.4Aug 6, 2026
• CVE-2025-13909Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure4.3Aug 6, 2026
• CVE-2025-12627Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions2.4Aug 6, 2026
• CVE-2025-14779Improper Access Control via Secret Type Management API in WSO2 Identity Server3.8Aug 6, 2026
• CVE-2025-11850Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]4.3Aug 6, 2026
• CVE-2025-13736Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery3.7Aug 6, 2026
• CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure4.0Aug 6, 2026
• CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks5.9Aug 6, 2026
• CVE-2024-8995Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access4.9Aug 6, 2026
• CVE-2026-2445Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification6.1Jul 20, 2026
• CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification6.1Jul 6, 2026
• CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation4.8Jul 4, 2026