CVE-2024-12141Medium· 4.3▾ SunlitThe product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.
An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.
identity_server 5.10.0identity_server 5.11.0identity_server 6.0.0identity_server 6.1.0identity_server 7.0.0identity_server 7.1.0Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11229High· 7.2Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
CVE-2025-13647Medium· 5.8Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-2372Medium· 5.4Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
CVE-2026-6647High· 7.4Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2024-4989Medium· 5.4Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks