CVE-2025-11229High· 7.2▾ TwilightThe system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal an…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
The system fails to properly enforce scope authorization when the authorize_all_scopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.
Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the authorize_all_scopes configuration deviates from its default disabled state.
identity_server >= 7.0.0 < 7.0.0.125identity_server >= 7.1.0 < 7.1.0.32org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt >= 7.0.78 < 7.0.78.137org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt >= 7.8.23 < 7.8.23.49Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-13647Medium· 5.8Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-12141Medium· 4.3Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
CVE-2026-6647High· 7.4Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2025-0326High· 7.4Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2025-13591Medium· 5.3Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery