CVE-2025-1397Medium· 4.8▾ SunlitWhen utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has be…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.
universal_gateway >= 4.5.0 < 4.5.0.10traffic_manager >= 4.5.0 < 4.5.0.10api_manager >= 3.1.0 < 3.1.0.321api_manager >= 3.2.0 < 3.2.0.414api_manager >= 3.2.1 < 3.2.1.50api_manager >= 4.0.0 < 4.0.0.335api_manager >= 4.1.0 < 4.1.0.211api_manager >= 4.2.0 < 4.2.0.150api_manager >= 4.3.0 < 4.3.0.63api_manager >= 4.4.0 < 4.4.0.26api_manager >= 4.5.0 < 4.5.0.10api_control_plane >= 4.5.0 < 4.5.0.11identity_server >= 5.10.0 < 5.10.0.346identity_server >= 5.11.0 < 5.11.0.396identity_server >= 6.0.0 < 6.0.0.232identity_server >= 6.1.0 < 6.1.0.224identity_server >= 7.0.0 < 7.0.0.93open_banking_am >= 2.0.0 < 2.0.0.370open_banking_iam >= 2.0.0 < 2.0.0.390identity_server_as_key_manager >= 5.10.0 < 5.10.0.339org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.2 < 6.4.2.155org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.111 < 6.4.111.134org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.176 < 6.4.176.25org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.4.180 < 6.4.180.11org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.8.0 < 6.8.0.49org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.9.6 < 6.9.6.22org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.11.21 < 6.11.21.75org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.16 < 6.13.16.15org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.19 < 6.13.19.9org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 6.13.27 < 6.13.27.2org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 7.0.26 < 7.0.26.58org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 1.0.26 < 1.0.26.6org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 1.0.26 < 1.0.26.7org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 1.0.31 < 1.0.31.3org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 1.1.0 < 1.1.0.2org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 2.0.4 < 2.0.4.3org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 2.1.1 < 2.1.1.2org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 2.2.0 < 2.2.0.3org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 2.2.4 < 2.2.4.1org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt >= 2.3.1 < 2.3.1.4Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2025-7043Medium· 5.4Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2025-7203Medium· 4.9Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2025-11229High· 7.2Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
CVE-2025-5769Medium· 6.1Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification