# Wso2 Identity Server vulnerabilities Source: https://junglewise.ai/threats/technologies/identity-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/identity-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Wso2 Identity Server: 0 in the last 7 days and 17 in the last 90 days, 3 of them critical and 2 exploited in the wild. The most recent, CVE-2025-11229, was published on 4 November 2026. 14 vulnerabilities in the last four weeks, up 600% on the four before (2). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 14 - Last 90 days: 17 - All time: 38 (3 critical, 2 exploited in the wild) ## About Wso2 Identity Server Identity management and authentication platform providing OAuth2, SAML, and OpenID Connect support. ## Latest Wso2 Identity Server vulnerabilities - [CVE-2025-11229: WSO2 Identity Server privilege escalation via client credentials grant type](https://junglewise.ai/threats/cve-2025-11229-the-system-fails-to-properly-enforce-scope-authorization-when-the) (high, CVSS 7.2, published 4 Nov 2026) - [CVE-2026-4052: WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is) (critical, CVSS 9.8, published 3 Nov 2026) - [CVE-2025-1397: WSO2 Access token issuance without IDP status validation](https://junglewise.ai/threats/cve-2025-1397-when-utilizing-jwt-bearer-or-saml2-bearer-grant-types-the-system) (medium, CVSS 4.8, published 3 Nov 2026) - [CVE-2024-9517: WSO2 refresh token grant account lockout bypass](https://junglewise.ai/threats/cve-2024-9517-the-refresh-token-grant-type-in-wso2-products-fails-to-re-validate) (medium, CVSS 4.9, published 2 Nov 2026) - [CVE-2026-18800: WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with) (medium, CVSS 4.4, published 2 Nov 2026) - [CVE-2025-13647: WSO2 Identity Server content-type validation bypass](https://junglewise.ai/threats/cve-2025-13647-the-affected-component-fails-to-enforce-expected-validation) (medium, CVSS 5.8, published 2 Nov 2026) - [CVE-2024-5617: WSO2 account lock bypass in multi-store authentication](https://junglewise.ai/threats/cve-2024-5617-the-account-lock-feature-fails-to-correctly-enforce-account) (medium, CVSS 4.8, published 2 Nov 2026) - [CVE-2026-6647: WSO2 Identity Server OAuth token revocation bypass with mixed-case usernames](https://junglewise.ai/threats/cve-2026-6647-in-deployments-of-wso2-identity-server-configured-with-a-case) (high, CVSS 7.4, published 28 Oct 2026) - [CVE-2024-7478: WSO2 username enumeration in external user store authentication](https://junglewise.ai/threats/cve-2024-7478-when-a-wso2-product-is-configured-to-use-an-external-user-store) (medium, CVSS 5.8, published 21 Oct 2026) - [CVE-2024-2323: WSO2 RemoteUserStoreManagerService insufficient password change validation](https://junglewise.ai/threats/cve-2024-2323-the-remoteuserstoremanagerservice-does-not-sufficiently-validate) (medium, CVSS 4.8, published 20 Oct 2026) - [CVE-2025-7203: WSO2 Management Console credentials exposure in remote logging](https://junglewise.ai/threats/cve-2025-7203-the-management-console-and-product-files-expose-sensitive-data) (medium, CVSS 4.9, published 19 Oct 2026) - [CVE-2025-13591: WSO2 Identity Server username enumeration in authentication endpoint](https://junglewise.ai/threats/cve-2025-13591-the-authentication-endpoint-of-wso2-identity-server-fails-to) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-10149: WSO2 Identity Server authorization bypass in SCIM endpoint](https://junglewise.ai/threats/cve-2025-10149-the-scim-endpoint-does-not-sufficiently-validate-authorization) (high, CVSS 8.2, published 19 Oct 2026) - [CVE-2025-5802: WSO2 Identity Server username enumeration in self-registration](https://junglewise.ai/threats/cve-2025-5802-wso2-identity-server-username-enumeration-in-self-registration) (medium, CVSS 5.3, published 15 Sep 2026) - [CVE-2025-13166: WSO2 Identity Server username enumeration in SMS OTP flow](https://junglewise.ai/threats/cve-2025-13166-wso2-identity-server-username-enumeration-in-sms-otp-flow) (low, CVSS 3.7, published 15 Sep 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2025-12317: WSO2 Identity Server improper token revocation via SOAP services](https://junglewise.ai/threats/cve-2025-12317-wso2-identity-server-improper-token-revocation-via-soap-services) (medium, CVSS 5, published 6 Aug 2026) - [CVE-2026-5430: WSO2 API Control Plane path traversal vulnerability](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026) - [CVE-2026-0637: When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded…](https://junglewise.ai/threats/cve-2026-0637-when-a-proxy-server-is-configured-with-customurl-enabled-the) (medium, CVSS 5.4, published 6 Aug 2026) - [CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This…](https://junglewise.ai/threats/cve-2024-8995-unused-authorization-codes-issued-to-deleted-users-are-not-being) (medium, CVSS 4.9, published 6 Aug 2026) - [CVE-2024-6832: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not…](https://junglewise.ai/threats/cve-2024-6832-the-account-locking-mechanism-fails-to-trigger-when-secondary-user) (medium, CVSS 5.9, published 6 Aug 2026) - [CVE-2024-10302: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness…](https://junglewise.ai/threats/cve-2024-10302-the-user-self-signup-flow-in-multiple-wso2-products-fails-to) (medium, CVSS 4, published 6 Aug 2026) - [CVE-2026-2445: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2026-2445-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 20 Jul 2026) - [CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2025-8591-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 6 Jul 2026) ## Most severe Wso2 Identity Server vulnerabilities - [CVE-2026-5430: WSO2 API Control Plane path traversal vulnerability](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026) - [CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability](https://junglewise.ai/threats/cve-2022-29464-wso2-multiple-products-unrestrictive-upload-of-file-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Apr 2022) - [CVE-2026-4052: WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is) (critical, CVSS 9.8, published 3 Nov 2026) - [CVE-2025-10470: WSO2 Identity Server denial of service in Magic Link authentication](https://junglewise.ai/threats/cve-2025-10470-wso2-identity-server-denial-of-service-in-magic-link) (high, CVSS 8.6, published 11 May 2026) - [CVE-2025-12107: WSO2 Identity Server Server-Side Template Injection in Velocity](https://junglewise.ai/threats/cve-2025-12107-wso2-identity-server-server-side-template-injection-in-velocity) (high, CVSS 8.4, published 19 Feb 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2025-10149: WSO2 Identity Server authorization bypass in SCIM endpoint](https://junglewise.ai/threats/cve-2025-10149-the-scim-endpoint-does-not-sufficiently-validate-authorization) (high, CVSS 8.2, published 19 Oct 2026) - [CVE-2024-2374: The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent…](https://junglewise.ai/threats/cve-2024-2374-the-xml-parsers-within-multiple-wso2-products-accept-user-supplied) (high, CVSS 7.5, published 16 Apr 2026) - [CVE-2026-6647: WSO2 Identity Server OAuth token revocation bypass with mixed-case usernames](https://junglewise.ai/threats/cve-2026-6647-in-deployments-of-wso2-identity-server-configured-with-a-case) (high, CVSS 7.4, published 28 Oct 2026) - [CVE-2025-10908: WSO2 Identity Server account lock bypass in Magic Link and Passkey](https://junglewise.ai/threats/cve-2025-10908-wso2-identity-server-account-lock-bypass-in-magic-link-and) (high, CVSS 7.3, published 11 May 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, up 600% on the four before (2). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 7 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wso2 technologies - [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager): 38 vulnerabilities - [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane): 26 vulnerabilities - [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager): 19 vulnerabilities - [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway): 19 vulnerabilities - [Wso2 Identity Server as Key Manager](https://junglewise.ai/threats/technologies/identity-server-as-key-manager): 15 vulnerabilities - [Wso2 Open Banking IAM](https://junglewise.ai/threats/technologies/open-banking-iam): 15 vulnerabilities - [Wso2 Open Banking AM](https://junglewise.ai/threats/technologies/open-banking-am): 11 vulnerabilities - [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wso2 Identity Server vulnerabilities", https://junglewise.ai/threats/technologies/identity-server, 12 November 2026.