CVE-2024-1248: WSO2 multiple products role overwrite in Silent JIT Provisioning

CVE-2024-1248 · Severity: medium · CVSS 4.8 · Published 2026-07-04

WSO2 products used for identity management and API security contain a flaw in how they handle user accounts when connecting to external login providers like Google. If an attacker knows a local user's username, they can potentially overwrite that user's permissions by logging in through an external provider with the same name. While this typically results in the local user receiving lower-level permissions, it disrupts normal operations and can lead to unauthorized role changes.

Technologies: Wso2 API Manager, Wso2 Identity Server, Wso2 Identity Server as Key Manager, Wso2 Open Banking AM, Wso2 Open Banking IAM. Vendors: Wso2.

Quick answers

Is CVE-2024-1248 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-1248 being exploited in the wild.
How severe is CVE-2024-1248?
Medium severity, with a CVSS score of 4.8, published 4 July 2026.
Which products and versions are affected?
Wso2 API Manager 3.0.0 before update 153, 3.1.0 before update 267, 3.2.0 before update 351, 4.0.0 before update 269, 4.1.0 before update 169; Wso2 Identity Server 5.8.0 before update 101, 5.9.0 before update 138, 5.10.0 before update 284, 5.11.0 before update 321; Wso2 Identity Server as Key Manager 5.9.0 before update 148, 5.10.0 before update 280; Wso2 Open Banking AM 2.0.0 before update 313; and 1 more.
Is there a fix for CVE-2024-1248?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-1248 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-1248?
Check whether you run Wso2 API Manager, Wso2 Identity Server, Wso2 Identity Server as Key Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A role management vulnerability exists in WSO2 products when 'Silent Just-In-Time (JIT) Provisioning' is enabled for federated authentication. The root cause is a failure to properly segregate user roles during account creation when a federated user (from an external IDP) shares a username with an existing local user. An attacker who knows a local username can use a public IDP to trigger the JIT process, causing the local user's roles to be overwritten by the roles defined in the federated IDP. This requires the attacker to have knowledge of a valid local username and for the system to be configured with a specific JIT provisioning mode. WSO2 has released updates for affected versions of API Manager, Identity Server, and Open Banking components to mitigate this issue.

Affected products

  • WSO2 API Manager 3.0.0 before update 153, 3.1.0 before update 267, 3.2.0 before update 351, 4.0.0 before update 269, 4.1.0 before update 169
  • WSO2 Identity Server 5.8.0 before update 101, 5.9.0 before update 138, 5.10.0 before update 284, 5.11.0 before update 321
  • WSO2 Identity Server as Key Manager 5.9.0 before update 148, 5.10.0 before update 280
  • WSO2 Open Banking AM 2.0.0 before update 313
  • WSO2 Open Banking IAM 2.0.0 before update 333

Timeline

  • 2026-05-03: advisory: Initial advisory published by WSO2
  • 2026-07-04: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.