Read the docs
TI-2025-43982 Aliases CVE-2025-14260GHSA-mqxf-9g4h-p3qm

SSRF in Multiple WSO2 Products Allows Access to Internal and External Resources

Priority LOW 38CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper implementation of access control rules lets a malicious actor perform a Server-Side Request Forgery (SSRF) attack on affected WSO2 products (CWE-918). The attacker can reach internal and external resources available over the network or filesystem, including resources inside a private network, as long as the WSO2 product can reach them, which may expose sensitive data and systems. The CVSS 3.1 base score is 8.3 (HIGH). CISA has not added it to KEV, and its SSVC rates exploitation as none, automatable as no and technical impact as total.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 3.1.0.354, 3.2.0.458, 3.2.1.99 +5WSO2 Identity Server as Key Manager (WSO2): 5.10.0.374+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager3.1.0 to before 3.1.0.354; 3.2.0 to before 3.2.0.458; 3.2.1 to before 3.2.1.99; 4.0.0 to before 4.0.0.379; 4.1.0 to before 4.1.0.265; 4.2.0 to before 4.2.0.205; 4.3.0 to before 4.3.0.115; 4.4.0 to before 4.4.0.793.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3745.10.0.374Patch availableCNA
WSO2WSO2 Open Banking AM2.0.0 to before 2.0.0.4032.0.0.403Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.4232.0.0.423Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.383; 5.11.0 to before 5.11.0.430; 6.0.0 to before 6.0.0.256; 6.1.0 to before 6.1.0.257; 7.0.0 to before 7.0.0.1345.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134Patch availableCNA
WSO2SAML2 SSO Authenticator UI Bundle5.5.0 to before 5.5.0.2; 5.5.2 to before 5.5.2.5; 5.5.9 to before 5.5.9.4; 5.5.10 to before 5.5.10.1; 5.6.4 to before 5.6.4.1; 5.7.2 to before 5.7.2.1; 5.8.3 to before 5.8.3.1; 5.8.7 to before 5.8.7.2; 5.9.4 to before 5.9.4.25.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2, 5.9.9Patch availableCNA
WSO2WSO2 Carbon UI4.6.0 to before 4.6.0.2300; 4.6.1 to before 4.6.1.165; 4.6.3 to before 4.6.3.46; 4.6.4 to before 4.6.4.28; 4.7.1 to before 4.7.1.79; 4.8.1 to before 4.8.1.50; 4.9.0 to before 4.9.0.107; 4.9.26 to before 4.9.26.37; 4.9.27 to before 4.9.27.24; 4.10.9 to before 4.10.9.774.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77, 4.10.42Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 3.1.0 to before 3.1.0.354; 3.2.0 to before 3.2.0.458; 3.2.1 to before 3.2.1.99; 4.0.0 to before 4.0.0.379; 4.1.0 to before 4.1.0.265; 4.2.0 to before 4.2.0.205; 4.3.0 to before 4.3.0.115; 4.4.0 to before 4.4.0.79 Fixed in 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.374 Fixed in 5.10.0.374 Patch available CNA
  • WSO2 Open Banking AM VendorWSO2 Affected 2.0.0 to before 2.0.0.403 Fixed in 2.0.0.403 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.423 Fixed in 2.0.0.423 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.383; 5.11.0 to before 5.11.0.430; 6.0.0 to before 6.0.0.256; 6.1.0 to before 6.1.0.257; 7.0.0 to before 7.0.0.134 Fixed in 5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134 Patch available CNA
  • SAML2 SSO Authenticator UI Bundle VendorWSO2 Affected 5.5.0 to before 5.5.0.2; 5.5.2 to before 5.5.2.5; 5.5.9 to before 5.5.9.4; 5.5.10 to before 5.5.10.1; 5.6.4 to before 5.6.4.1; 5.7.2 to before 5.7.2.1; 5.8.3 to before 5.8.3.1; 5.8.7 to before 5.8.7.2; 5.9.4 to before 5.9.4.2 Fixed in 5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2, 5.9.9 Patch available CNA
  • WSO2 Carbon UI VendorWSO2 Affected 4.6.0 to before 4.6.0.2300; 4.6.1 to before 4.6.1.165; 4.6.3 to before 4.6.3.46; 4.6.4 to before 4.6.4.28; 4.7.1 to before 4.7.1.79; 4.8.1 to before 4.8.1.50; 4.9.0 to before 4.9.0.107; 4.9.26 to before 4.9.26.37; 4.9.27 to before 4.9.27.24; 4.10.9 to before 4.10.9.77 Fixed in 4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77, 4.10.42 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*——WSO2
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions — — ·WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Upgrade each affected product to a fixed version: WSO2 API Manager 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115 or 4.4.0.79; WSO2 Identity Server as Key Manager 5.10.0.374; WSO2 Open Banking AM 2.0.0.403; WSO2 Open Banking IAM 2.0.0.423; WSO2 Identity Server 5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257 or 7.0.0.134; SAML2 SSO Authenticator UI Bundle 5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2 or 5.9.9; WSO2 Carbon UI 4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77 or 4.10.42.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.374
  • Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 2.0.0.403
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.423
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134
  • Fix · CNA SAML2 SSO Authenticator UI Bundle (WSO2) Fixed in 5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2, 5.9.9
  • Fix · CNA WSO2 Carbon UI (WSO2) Fixed in 4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77, 4.10.42

Timeline

  1. 2026-10-28 Threatist record created from CVE-2025-14260
  2. 2026-10-28 Alias added: GHSA-mqxf-9g4h-p3qm
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-11-03 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences