org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework vulnerabilities
CVEs whose affected-version data names the org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2024-4412Low· 2.7Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploit…
CVE-2025-5802Medium· 5.3The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error messag…