Read the docs
TI-2024-39158 Aliases CVE-2024-12141GHSA-v82f-j8qg-grcv

Open redirect in WSO2 Identity Server enables phishing

Priority LOW 19CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

WSO2 Identity Server from 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0 and 7.1.0 does not sufficiently validate callback URLs, which can be manipulated through a weak regular expression or when validation is omitted (CWE-601). A remote attacker can craft a link that looks legitimate and, when a user opens it, redirects the user to an attacker-controlled page. This enables phishing that harvests sensitive user information, which can lead to unauthorized access or data theft.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Identity Server5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0—No fix listedCNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0; 5.11.0; 6.0.0; 6.1.0; 7.0.0; 7.1.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

The sources list no fixed version for WSO2 Identity Server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

  1. 2026-11-02 Threatist record created from CVE-2024-12141
  2. 2026-11-02 Alias added: GHSA-v82f-j8qg-grcv
  3. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences