Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2026-2085 13 CVEs

WSO2 API Manager: Mehrere Schwachstellen

Published Jun 25, 2026 · Updated Nov 2, 2026 · Revision 9 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um seine Privilegien zu erhöhen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.

Product

WSO2 API Manager ist eine Open-Source-Plattform für das Management von APIs, die deren Erstellung, Veröffentlichung, Steuerung und Analyse ermöglicht.

Vulnerabilities 13

  • Critical 10.0
    CVE-2026-5430 Exploited Public exploit EPSS 22%

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
    KEV Sep 24, 2026
  • Critical 9.8
    CVE-2026-1728

    Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

    Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potential…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
  • Critical 9.8
    CVE-2026-4052

    Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

    This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from th…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Identity Server Key Manager Connector (apim-km-wso2is)
  • Critical 9.1
    CVE-2026-3418

    Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

    The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access wi…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
  • High 8.7
    CVE-2026-2613

    SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

    The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enab…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
  • High 8.7
    CVE-2026-3415

    XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

    The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
  • High 8.6
    CVE-2026-4249

    Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

    The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
  • High 8.3
    CVE-2026-2053

    Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

    The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitr…

    WSO2 WSO2 API Manager
  • Medium 6.8
    CVE-2025-5717

    Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service

    An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying …

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Open Banking AM
  • Medium 6.5
    CVE-2025-13173

    Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

    Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token up…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager
  • Medium 6.1
    CVE-2026-2445

    Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

    The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leve…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 API Control Plane
  • Medium 5.4
    CVE-2025-13394

    Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

    The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute …

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager
  • Medium 5.4
    CVE-2026-0637

    Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery

    When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construc…

    WSO2 WSO2 API Manager WSO2 API Control Plane

Revision history

  1. #9

    Referenz(en) aufgenommen: EUVD-2026-115116

  2. #8

    Referenz(en) aufgenommen: EUVD-2025-211120

  3. #7

    Exploit CVE-2026-5430

  4. #6

    Referenz(en) aufgenommen: EUVD-2026-53820, EUVD-2026-54209, EUVD-2026-54208

  5. #5

    Referenz(en) aufgenommen: EUVD-2026-53821, EUVD-2026-53822, EUVD-2025-210631

  6. #4

    Referenz(en) aufgenommen: EUVD-2026-45898, GHSA-VCJ5-R64M-JR4F

  7. #3

    Referenz(en) aufgenommen: EUVD-2026-41871

  8. #2

    Referenz(en) aufgenommen: EUVD-2026-39638

  9. #1

    Initiale Fassung

References