CVE-2024-1440

Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint

State: Published
Severity: 5.4 Medium
Published: Jun 2, 2025
Updated: Jun 2, 2025
Reserved: Feb 12, 2024

Description

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.

By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	WSO2

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.278Affected 5.11.0 to before 5.11.0.347Affected 6.0.0 to before 6.0.0.185Affected 6.1.0 to before 6.1.0.145Affected 7.0.0 to before 7.0.0.30Affected
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.262Affected 3.2.0 to before 3.2.0.344Affected 4.0.0 to before 4.0.0.296Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.298Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.308Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.327Affected
WSO2 Carbon Identity Application Authentication Endpoint(Utils)WSO2	5.17.5 to before 5.17.5.256Affected 5.18.187 to before 5.18.187.257Affected 5.23.8 to before 5.23.8.174Affected 5.25.92 to before 5.25.92.77Affected 7.0.78 to before 7.0.78.18Affected 7.0.111 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.