CVE-2025-10149: WSO2 Identity Server authorization bypass in SCIM endpoint

CVE-2025-10149 · Severity: high · CVSS 8.2 · Published 2026-10-19

WSO2 Identity Server is an identity and access management platform used to authenticate users and manage access to enterprise applications. A security flaw in its SCIM user provisioning endpoints allows attackers authenticated as federated users to take over local user accounts when usernames overlap, potentially gaining full control over those accounts. This affects organizations using federated authentication without user self-registration protections.

Technologies: Wso2 Identity Server, Wso2 Identity Server as Key Manager, Wso2 Open Banking IAM. Vendors: Wso2.

Quick answers

Is CVE-2025-10149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-10149 being exploited in the wild.
How severe is CVE-2025-10149?
High severity, with a CVSS score of 8.2, published 19 October 2026.
Which products and versions are affected?
Wso2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0; Wso2 Identity Server as Key Manager 5.10.0; Wso2 Open Banking IAM 2.0.0.
Is there a fix for CVE-2025-10149?
Yes: fixed in WSO2 Identity Server 7.1.0 Update 34, 7.0.0 Update 127, 6.1.0 Update 251, 6.0.0 Update 251, 5.11.0 Update 415, 5.10.0 Update 379; WSO2 Identity Server as Key Manager 5.10.0 Update 370; WSO2 Open Banking IAM 2.0.0 Update 419. Until then: Deployments that do not support user self-registration are considered medium severity rather than high severity. Community users can apply the provided public fixes from the referenced GitHub pull requests if upgrading is not immediately feasible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10149 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-10149?
Check whether you run Wso2 Identity Server, Wso2 Identity Server as Key Manager or Wso2 Open Banking IAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: WSO2 Identity Server 7.1.0 Update 34, 7.0.0 Update 127, 6.1.0 Update 251, 6.0.0 Update 251, 5.11.0 Update 415, 5.10.0 Update 379; WSO2 Identity Server as Key Manager 5.10.0 Update 370; WSO2 Open Banking IAM 2.0.0 Update 419

Deployments that do not support user self-registration are considered medium severity rather than high severity. Community users can apply the provided public fixes from the referenced GitHub pull requests if upgrading is not immediately feasible.

Technical details

The SCIM 2.0 and SCIM 1.1 endpoints fail to properly validate authorization when federated users perform operations against the local user store, specifically when a local and federated user share the same username. A federated user can exploit this to perform arbitrary operations on local accounts, including account takeover. The vulnerability requires the attacker to be authenticated as a federated user and relies on username collision between federated and local user stores.

Affected products

  • WSO2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0
  • WSO2 Identity Server as Key Manager 5.10.0
  • WSO2 Open Banking IAM 2.0.0

Timeline

  • 2026-05-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.