Executive brief
WSO2 products used for identity management and API security contain a flaw in how they handle user accounts when connecting to external login providers like Google. If an attacker knows a local user's username, they can potentially overwrite that user's permissions by logging in through an external provider with the same name. While this typically results in the local user receiving lower-level permissions, it disrupts normal operations and can lead to unauthorized role changes.
Technical details
A role management vulnerability exists in WSO2 products when 'Silent Just-In-Time (JIT) Provisioning' is enabled for federated authentication. The root cause is a failure to properly segregate user roles during account creation when a federated user (from an external IDP) shares a username with an existing local user. An attacker who knows a local username can use a public IDP to trigger the JIT process, causing the local user's roles to be overwritten by the roles defined in the federated IDP. This requires the attacker to have knowledge of a valid local username and for the system to be configured with a specific JIT provisioning mode. WSO2 has released updates for affected versions of API Manager, Identity Server, and Open Banking components to mitigate this issue.
Affected products
- WSO2 API Manager 3.0.0 before update 153, 3.1.0 before update 267, 3.2.0 before update 351, 4.0.0 before update 269, 4.1.0 before update 169
- WSO2 Identity Server 5.8.0 before update 101, 5.9.0 before update 138, 5.10.0 before update 284, 5.11.0 before update 321
- WSO2 Identity Server as Key Manager 5.9.0 before update 148, 5.10.0 before update 280
- WSO2 Open Banking AM 2.0.0 before update 313
- WSO2 Open Banking IAM 2.0.0 before update 333
Timeline
- 2026-05-03: advisory: Initial advisory published by WSO2
- 2026-07-04: disclosed: CVE published to NVD dataset