CVE-2025-13647Medium· 5.8▾ SunlitThe affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Success…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The affected component fails to enforce expected validation constraints on the content-type header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated content-type header.
Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
identity_server >= 5.10.0 < 5.10.0.381identity_server >= 5.11.0 < 5.11.0.428identity_server >= 6.0.0 < 6.0.0.255identity_server >= 6.1.0 < 6.1.0.255identity_server >= 7.0.0 < 7.0.0.133identity_server >= 7.1.0 < 7.1.0.41identity_server >= 7.2.0 < 7.2.0.3open_banking_iam >= 2.0.0 < 2.0.0.421identity_server_as_key_manager >= 5.10.0 < 5.10.0.372org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.82 < 1.0.82.25org.wso2.carbon.identity.api.server.keystore.management.common >= 1.0.190 < 1.0.190.17org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.3 < 1.2.3.6org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.23 < 1.2.23.10org.wso2.carbon.identity.api.server.keystore.management.common >= 1.2.176 < 1.2.176.18org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.83 < 1.3.83.10org.wso2.carbon.identity.api.server.keystore.management.common >= 1.3.213 < 1.3.213.1org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.0.82 < 1.0.82.25org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.0.190 < 1.0.190.17org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.3 < 1.2.3.6org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.23 < 1.2.23.10org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.2.176 < 1.2.176.18org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.3.83 < 1.3.83.10org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1 >= 1.3.213 < 1.3.213.1Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11229High· 7.2Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
CVE-2024-12141Medium· 4.3Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
CVE-2026-6647High· 7.4Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2025-0326High· 7.4Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2025-13591Medium· 5.3Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery