CVE-2025-13475Low· 3.5▾ SunlitIn multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing.
This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.
api_manager >= 3.2.0, < 3.2.0.457api_manager >= 3.2.1, < 3.2.1.76identity_server >= 5.10.0, < 5.10.0.382Upgrade past the affected range:
api_manager 3.2.1.76identity_server 5.10.0.382Connected by shared product, vendor, weakness, or advisory.
CVE-2024-8008Medium· 5.2A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request
CVE-2025-6024Medium· 6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint
CVE-2025-13736Low· 3.7When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts
CVE-2024-6423Medium· 4.0Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
CVE-2024-5139Medium· 6.1Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks