Read the docs
TI-2026-00435 Aliases CVE-2026-0637GHSA-q9jj-jm6w-fpgf

Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs. An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 3.2.0.464, 3.2.1.83, 4.1.0.249 +5WSO2 API Control Plane (WSO2): 4.5.0.45, 4.6.0.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager3.2.0 to before 3.2.0.464; 3.2.1 to before 3.2.1.83; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.44; 4.6.0 to before 4.6.0.123.2.0.464, 3.2.1.83, 4.1.0.249, 4.2.0.189, 4.3.0.99, 4.4.0.63, 4.5.0.44, 4.6.0.12Patch availableCNA
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.45; 4.6.0 to before 4.6.0.134.5.0.45, 4.6.0.13Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 3.2.0 to before 3.2.0.464; 3.2.1 to before 3.2.1.83; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.44; 4.6.0 to before 4.6.0.12 Fixed in 3.2.0.464, 3.2.1.83, 4.1.0.249, 4.2.0.189, 4.3.0.99, 4.4.0.63, 4.5.0.44, 4.6.0.12 Patch available CNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.45; 4.6.0 to before 4.6.0.13 Fixed in 4.5.0.45, 4.6.0.13 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.50; 4.6.0 to before 4.6.0.14VulnerableWSO2
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*3.1.0 to before 3.1.0.357; 3.2.0 to before 3.2.0.465; 3.2.1 to before 3.2.1.84; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.100; 4.4.0 to before 4.4.0.64; 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13VulnerableWSO2
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*5.10.0 to before 5.10.0.386; 5.11.0 to before 5.11.0.433; 6.0.0 to before 6.0.0.260; 6.1.0 to before 6.1.0.261VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*5.10.0 to before 5.10.0.377VulnerableWSO2
cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*2.0.0 to before 2.0.0.406VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*2.0.0 to before 2.0.0.426VulnerableWSO2
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.13VulnerableWSO2
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13VulnerableWSO2
  • cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.50; 4.6.0 to before 4.6.0.14 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.1.0.357; 3.2.0 to before 3.2.0.465; 3.2.1 to before 3.2.1.84; 4.1.0 to before 4.1.0.249; 4.2.0 to before 4.2.0.189; 4.3.0 to before 4.3.0.100; 4.4.0 to before 4.4.0.64; 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions 5.10.0 to before 5.10.0.386; 5.11.0 to before 5.11.0.433; 6.0.0 to before 6.0.0.260; 6.1.0 to before 6.1.0.261 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:* Versions 5.10.0 to before 5.10.0.377 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.0.406 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.0.426 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.13 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.2.0.464, 3.2.1.83, 4.1.0.249, 4.2.0.189, 4.3.0.99, 4.4.0.63, 4.5.0.44, 4.6.0.12
  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.45, 4.6.0.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0637
  2. 2026-10-03 Alias added: GHSA-q9jj-jm6w-fpgf
  3. 2026-11-04 Title updated · CNA
  4. 2026-11-04 CVSS score changed · CNA
  5. 2026-11-04 Weakness changed · CNA
  6. 2026-11-04 Fix available: WSO2/WSO2 API Control [email protected], WSO2/WSO2 API Control [email protected], WSO2/WSO2 API [email protected] +5 · CNA
  7. 2026-11-04 1 new reference · CNA

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences