CVE-2025-14260
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
| CWE | CWE-918 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Oct 28, 2026 |
| Last Updated | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new high vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
WSO2 / WSO2 API Manager
3.1.0 < 3.1.0.354 3.2.0 < 3.2.0.458 3.2.1 < 3.2.1.99 4.0.0 < 4.0.0.379 4.1.0 < 4.1.0.265 4.2.0 < 4.2.0.205 4.3.0 < 4.3.0.115 4.4.0 < 4.4.0.79
WSO2 / WSO2 Identity Server as Key Manager
5.10.0 < 5.10.0.374
WSO2 / WSO2 Open Banking AM
2.0.0 < 2.0.0.403
WSO2 / WSO2 Open Banking IAM
2.0.0 < 2.0.0.423
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.383 5.11.0 < 5.11.0.430 6.0.0 < 6.0.0.256 6.1.0 < 6.1.0.257 7.0.0 < 7.0.0.134
WSO2 / SAML2 SSO Authenticator UI Bundle
5.5.0 < 5.5.0.2 5.5.2 < 5.5.2.5 5.5.9 < 5.5.9.4 5.5.10 < 5.5.10.1 5.6.4 < 5.6.4.1 5.7.2 < 5.7.2.1 5.8.3 < 5.8.3.1 5.8.7 < 5.8.7.2 5.9.4 < 5.9.4.2
WSO2 / WSO2 Carbon UI
4.6.0 < 4.6.0.2300 4.6.1 < 4.6.1.165 4.6.3 < 4.6.3.46 4.6.4 < 4.6.4.28 4.7.1 < 4.7.1.79 4.8.1 < 4.8.1.50 4.9.0 < 4.9.0.107 4.9.26 < 4.9.26.37 4.9.27 < 4.9.27.24 4.10.9 < 4.10.9.77
References
Credits
Huong Kieu