---
id: CVE-2026-0637
title: >-
  Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows
  Open Redirect and Log Forgery
summary: >-
  When a proxy server is configured with `customUrl.enabled`, the component
  accepts user-supplied input within forwarded HTTP headers without enforcing
  expected validation constraints. A malicious actor can manipulate these
  headers to infl…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-20
  - CWE-74
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 3.2.0 < 3.2.0.464
  - api_manager >= 3.2.1 < 3.2.1.83
  - api_manager >= 4.1.0 < 4.1.0.249
  - api_manager >= 4.2.0 < 4.2.0.189
  - api_manager >= 4.3.0 < 4.3.0.99
  - api_manager >= 4.4.0 < 4.4.0.63
  - api_manager >= 4.5.0 < 4.5.0.44
  - api_manager >= 4.6.0 < 4.6.0.12
  - api_control_plane >= 4.5.0 < 4.5.0.45
  - api_control_plane >= 4.6.0 < 4.6.0.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-06T12:32:02.648926Z'
published: '2026-08-06'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T13:47:20.802Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-0637'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.0545
ingestedAt: '2026-11-05T20:33:06.743Z'
---

## Overview

When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.

An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.

## Affected

- `api_manager >= 3.2.0 < 3.2.0.464`
- `api_manager >= 3.2.1 < 3.2.1.83`
- `api_manager >= 4.1.0 < 4.1.0.249`
- `api_manager >= 4.2.0 < 4.2.0.189`
- `api_manager >= 4.3.0 < 4.3.0.99`
- `api_manager >= 4.4.0 < 4.4.0.63`
- `api_manager >= 4.5.0 < 4.5.0.44`
- `api_manager >= 4.6.0 < 4.6.0.12`
- `api_control_plane >= 4.5.0 < 4.5.0.45`
- `api_control_plane >= 4.6.0 < 4.6.0.13`

## Remediation

Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/#solution