CVE-2024-10302Medium· 4.0▾ SunlitThe user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes.
Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.
api_control_plane = 4.5.0api_manager = 3.1.0api_manager = 3.2.0api_manager = 3.2.1api_manager = 4.0.0api_manager = 4.1.0api_manager = 4.2.0api_manager = 4.3.0api_manager = 4.5.0identity_server = 5.10.0identity_server = 5.11.0identity_server_as_key_manager = 5.10.0open_banking_iam = 2.0.0traffic_manager = 4.5.0universal_gateway = 4.5.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-6423Medium· 4.0Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
CVE-2025-8154Medium· 5.3In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
CVE-2025-8325Medium· 6.3The software fails to enforce role-based access controls for certain Gateway API invocations
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser
CVE-2025-15039Critical· 9.4The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured
CVE-2025-13909Medium· 4.3The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators