{"id":"CVE-2024-12141","title":"Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks","summary":"The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-601"],"vendor":"WSO2","product":"WSO2 Identity Server","affected":["identity_server 5.10.0","identity_server 5.11.0","identity_server 6.0.0","identity_server 6.1.0","identity_server 7.0.0","identity_server 7.1.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T16:54:03.541515Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:54:16.889Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-12141","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/"}],"tags":["cve.org"],"epss":0.00203,"epssPercentile":0.10329,"ingestedAt":"2026-11-05T19:30:42.713Z","slug":"CVE-2024-12141","body":"## Overview\n\nThe product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.\n\n## Affected\n\n- `identity_server 5.10.0`\n- `identity_server 5.11.0`\n- `identity_server 6.0.0`\n- `identity_server 6.1.0`\n- `identity_server 7.0.0`\n- `identity_server 7.1.0`\n\n## Remediation\n\nFollow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/#solution","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}