Read the docs
TI-2024-09547 Aliases CVE-2024-10302GHSA-26pj-57w8-hvrq

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed WSO2 API Control Plane (WSO2): 4.5.0.10WSO2 Traffic Manager (WSO2): 4.5.0.9+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.104.5.0.10Patch availableCNA
WSO2WSO2 Traffic Manager4.5.0 to before 4.5.0.94.5.0.9Patch availableCNA
WSO2WSO2 Universal Gateway4.5.0 to before 4.5.0.94.5.0.9Patch availableCNA
WSO2WSO2 API Manager3.1.0 to before 3.1.0.331; 3.2.0 to before 3.2.0.427; 3.2.1 to before 3.2.1.39; 4.0.0 to before 4.0.0.318; 4.1.0 to before 4.1.0.200; 4.2.0 to before 4.2.0.138; 4.3.0 to before 4.3.0.51; 4.5.0 to before 4.5.0.93.1.0.331, 3.2.0.427, 3.2.1.39, 4.0.0.318, 4.1.0.200, 4.2.0.138, 4.3.0.51, 4.5.0.9Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.4002.0.0.400Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3515.10.0.351Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.358; 5.11.0 to before 5.11.0.3795.10.0.358, 5.11.0.379Patch availableCNA
WSO2WSO2 Carbon Identity Recovery Management1.4.1 to before 1.4.1.72; 1.4.72 to before 1.4.72.68; 1.4.100 to before 1.4.100.8; 1.4.102 to before 1.4.102.2; 1.7.2 to before 1.7.2.4; 1.8.107 to before 1.8.107.2; 1.8.108 to before 1.8.108.41.4.1.72, 1.4.72.68, 1.4.100.8, 1.4.102.2, 1.7.2.4, 1.8.107.2, 1.8.108.4, 1.6.380, 1.8.109Patch availableCNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.10 Fixed in 4.5.0.10 Patch available CNA
  • WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.9 Fixed in 4.5.0.9 Patch available CNA
  • WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.9 Fixed in 4.5.0.9 Patch available CNA
  • WSO2 API Manager VendorWSO2 Affected 3.1.0 to before 3.1.0.331; 3.2.0 to before 3.2.0.427; 3.2.1 to before 3.2.1.39; 4.0.0 to before 4.0.0.318; 4.1.0 to before 4.1.0.200; 4.2.0 to before 4.2.0.138; 4.3.0 to before 4.3.0.51; 4.5.0 to before 4.5.0.9 Fixed in 3.1.0.331, 3.2.0.427, 3.2.1.39, 4.0.0.318, 4.1.0.200, 4.2.0.138, 4.3.0.51, 4.5.0.9 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.400 Fixed in 2.0.0.400 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.351 Fixed in 5.10.0.351 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.358; 5.11.0 to before 5.11.0.379 Fixed in 5.10.0.358, 5.11.0.379 Patch available CNA
  • WSO2 Carbon Identity Recovery Management VendorWSO2 Affected 1.4.1 to before 1.4.1.72; 1.4.72 to before 1.4.72.68; 1.4.100 to before 1.4.100.8; 1.4.102 to before 1.4.102.2; 1.7.2 to before 1.7.2.4; 1.8.107 to before 1.8.107.2; 1.8.108 to before 1.8.108.4 Fixed in 1.4.1.72, 1.4.72.68, 1.4.100.8, 1.4.102.2, 1.7.2.4, 1.8.107.2, 1.8.108.4, 1.6.380, 1.8.109 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_control_plane:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
  • cpe:2.3:a:wso2:api_control_plane:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableWSO2
  • cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.10
  • Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.9
  • Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.9
  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.1.0.331, 3.2.0.427, 3.2.1.39, 4.0.0.318, 4.1.0.200, 4.2.0.138, 4.3.0.51, 4.5.0.9
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.400
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.351
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.358, 5.11.0.379
  • Fix · CNA WSO2 Carbon Identity Recovery Management (WSO2) Fixed in 1.4.1.72, 1.4.72.68, 1.4.100.8, 1.4.102.2, 1.7.2.4, 1.8.107.2, 1.8.108.4, 1.6.380, 1.8.109

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10302
  2. 2026-10-03 Alias added: GHSA-26pj-57w8-hvrq

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences