Read the docs
TI-2024-39143 Aliases CVE-2024-4989GHSA-xghc-f7xh-fw48

Open Redirect via Callback URL in WSO2 API Manager

Priority LOW 24CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

WSO2 API Manager from 4.1.0 before 4.1.0.153, from 4.2.0 before 4.2.0.105, and from 4.3.0 before 4.3.0.20 fails to validate the callback URL parameter. An unauthenticated remote attacker can redirect users to attacker-controlled web pages, which can be combined with social engineering to trick users into opening malicious links for phishing (CWE-601).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 4.1.0.153, 4.2.0.105, 4.3.0.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager4.1.0 to before 4.1.0.153; 4.2.0 to before 4.2.0.105; 4.3.0 to before 4.3.0.204.1.0.153, 4.2.0.105, 4.3.0.20Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 4.1.0 to before 4.1.0.153; 4.2.0 to before 4.2.0.105; 4.3.0 to before 4.3.0.20 Fixed in 4.1.0.153, 4.2.0.105, 4.3.0.20 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Update WSO2 API Manager to 4.1.0.153, 4.2.0.105, or 4.3.0.20, or a later release in the same branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 4.1.0.153, 4.2.0.105, 4.3.0.20

Timeline

  1. 2026-10-21 Threatist record created from CVE-2024-4989
  2. 2026-10-21 Alias added: GHSA-xghc-f7xh-fw48
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences