Read the docs
TI-2025-00557 Aliases CVE-2025-0663GHSA-9c82-vpf4-hvh3

Improper authentication in WSO2 Open Banking IAM

Priority LOW 32CWE-287Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants. Because the Auto-Login feature is enabled by default, this flaw may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Successful exploitation requires access to Adaptive Authentication functionality, which is typically restricted to high-privileged users. The vulnerability is only exploitable when Auto-Login is enabled, reducing its practical impact in deployments where the feature is disabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed WSO2 Open Banking IAM (WSO2): 2.0.0.387WSO2 Identity Server as Key Manager (WSO2): 5.10.0.336+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.3872.0.0.387Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3365.10.0.336Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.343; 5.11.0 to before 5.11.0.392; 6.0.0 to before 6.0.0.228; 6.1.0 to before 6.1.0.220; 7.0.0 to before 7.0.0.885.10.0.343, 5.11.0.392, 6.0.0.228, 6.1.0.220, 7.0.0.88Patch availableCNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.387 Fixed in 2.0.0.387 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.336 Fixed in 5.10.0.336 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.343; 5.11.0 to before 5.11.0.392; 6.0.0 to before 6.0.0.228; 6.1.0 to before 6.1.0.220; 7.0.0 to before 7.0.0.88 Fixed in 5.10.0.343, 5.11.0.392, 6.0.0.228, 6.1.0.220, 7.0.0.88 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*6.1.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
  • cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.387
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.336
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.343, 5.11.0.392, 6.0.0.228, 6.1.0.220, 7.0.0.88

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0663
  2. 2026-10-03 Alias added: GHSA-9c82-vpf4-hvh3

References

Advisory 1

  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2018-06290 WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. CVSS 3.0MEDIUM 5.4
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2024-06413 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover CVSS 3.1CRITICAL 9.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences