CVE-2026-4052Critical· 9.8▾ MidnightThis issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obt…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
api_manager 4.1.0api_manager 4.2.0api_manager 4.3.0api_manager 4.4.0api_manager 4.5.0api_manager 4.6.0api_control_plane 4.5.0api_control_plane 4.6.0org.wso2.km.ext.wso2is:wso2is.key.manager.core < 1.8.8Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-7043Medium· 5.4Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2025-1397Medium· 4.8Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
CVE-2024-5617Medium· 4.8Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2025-11969Critical· 9.4Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CVE-2024-12139Medium· 4.3Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks