Riskcovery

CVE-2024-4989

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

State
Published
Severity
5.4 Medium
Published
Oct 21, 2026
Updated
Oct 30, 2026
Reserved
May 16, 2024

Read the record on cve.org

Description

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.

Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 4.1.0Unknown
  • 4.1.0 to before 4.1.0.153Affected
  • 4.2.0 to before 4.2.0.105Affected
  • 4.3.0 to before 4.3.0.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.