CVE-2026-0637Medium· 5.4▾ SunlitWhen a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to infl…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
When a proxy server is configured with customUrl.enabled, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.
An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
api_manager >= 3.2.0 < 3.2.0.464api_manager >= 3.2.1 < 3.2.1.83api_manager >= 4.1.0 < 4.1.0.249api_manager >= 4.2.0 < 4.2.0.189api_manager >= 4.3.0 < 4.3.0.99api_manager >= 4.4.0 < 4.4.0.63api_manager >= 4.5.0 < 4.5.0.44api_manager >= 4.6.0 < 4.6.0.12api_control_plane >= 4.5.0 < 4.5.0.45api_control_plane >= 4.6.0 < 4.6.0.13Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-6423Medium· 4.0Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2024-5617Medium· 4.8Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2025-11969Critical· 9.4Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CVE-2024-12139Medium· 4.3Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
CVE-2026-18800Medium· 4.4Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data