CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

State: Published
Severity: 5.4 Medium
Published: Aug 6, 2026
Updated: Aug 6, 2026
Reserved: Nov 19, 2025

Description

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.

An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L	WSO2

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.381Affected 5.11.0 to before 5.11.0.428Affected 6.0.0 to before 6.0.0.255Affected 6.1.0 to before 6.1.0.256Affected 7.0.0 to before 7.0.0.133Affected 7.1.0 to before 7.1.0.41Affected 7.2.0 to before 7.2.0.3Affected
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.352Affected 3.2.0 to before 3.2.0.456Affected 3.2.1 to before 3.2.1.75Affected 4.0.0 to before 4.0.0.376Affected 4.1.0 to before 4.1.0.239Affected 4.2.0 to before 4.2.0.179Affected 4.3.0 to before 4.3.0.91Affected 4.4.0 to before 4.4.0.55Affected 4.5.0 to before 4.5.0.38Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.421Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.401Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.372Affected
WSO2 API Control PlaneWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.39Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Universal GatewayWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.37Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Traffic ManagerWSO2	before 4.5.0Unknown 4.5.0 to before 4.5.0.37Affected 4.6.0 to before 4.6.0.3Affected
WSO2 Enterprise IntegratorWSO2	before 6.6.0Unknown 6.6.0 to before 6.6.0.227Affected
WSO2 Carbon Identity Entitlement UIWSO2	5.17.5 to before 5.17.5.331Affected 5.18.187 to before 5.18.187.329Affected 5.23.8 to before 5.23.8.210Affected 5.25.92 to before 5.25.92.166Affected 7.0.78 to before 7.0.78.157Affected x and laterNot affected
WSO2 Carbon Identity Management UI1WSO2	5.17.5 to before 5.17.5.330Affected 5.17.5 to before 5.17.5.331Affected 5.17.118 to before 5.17.118.22Affected 5.18.187 to before 5.18.187.328Affected 5.18.187 to before 5.18.187.329Affected 5.18.248 to before 5.18.248.31Affected 5.23.8 to before 5.23.8.210Affected 5.24.8 to before 5.24.8.26Affected 5.25.92 to before 5.25.92.166Affected 5.25.705 to before 5.25.705.21Affected 5.25.713 to before 5.25.713.10Affected 5.25.724 to before 5.25.724.5Affected 5.25.736 to before 5.25.736.1Affected 7.0.78 to before 7.0.78.157Affected 7.8.23 to before 7.8.23.67Affected 7.8.586 to before 7.8.586.7Affected x and laterNot affected
WSO2 Carbon Identity User Store Configuration UIWSO2	5.14.127 to before 5.14.127.13Affected 5.17.5 to before 5.17.5.330Affected 5.17.5 to before 5.17.5.331Affected 5.17.118 to before 5.17.118.22Affected 5.18.187 to before 5.18.187.328Affected 5.18.187 to before 5.18.187.329Affected 5.18.248 to before 5.18.248.31Affected 5.23.8 to before 5.23.8.210Affected 5.24.8 to before 5.24.8.26Affected 5.25.92 to before 5.25.92.166Affected 5.25.705 to before 5.25.705.21Affected 5.25.713 to before 5.25.713.10Affected 5.25.724 to before 5.25.724.5Affected 5.25.736 to before 5.25.736.1Affected 7.0.78 to before 7.0.78.157Affected 7.8.23 to before 7.8.23.67Affected 7.8.586 to before 7.8.586.7Affected x and laterNot affected
WSO2 Carbon Registry Profiles UIWSO2	4.7.32 to before 4.7.32.18Affected 4.7.33 to before 4.7.33.16Affected 4.8.9 to before 4.8.9.16Affected 4.8.12 to before 4.8.12.8Affected 4.8.24 to before 4.8.24.6Affected 4.8.43 to before 4.8.43.4Affected 4.8.50 to before 4.8.50.3Affected x and laterNot affected
WSO2 Carbon Registry Properties UIWSO2	4.7.24 to before 4.7.24.11Affected 4.7.32 to before 4.7.32.16Affected 4.7.32 to before 4.7.32.18Affected 4.7.33 to before 4.7.33.16Affected 4.7.35 to before 4.7.35.15Affected 4.7.39 to before 4.7.39.12Affected 4.7.51 to before 4.7.51.8Affected 4.8.3 to before 4.8.3.10Affected 4.8.9 to before 4.8.9.16Affected 4.8.12 to before 4.8.12.8Affected 4.8.13 to before 4.8.13.9Affected 4.8.24 to before 4.8.24.6Affected 4.8.32 to before 4.8.32.4Affected 4.8.36 to before 4.8.36.2Affected 4.8.43 to before 4.8.43.2Affected 4.8.43 to before 4.8.43.4Affected 4.8.50 to before 4.8.50.1Affected 4.8.50 to before 4.8.50.3Affected x and laterNot affected
WSO2 Carbon Registry Resources UIWSO2	4.7.24 to before 4.7.24.11Affected 4.7.32 to before 4.7.32.16Affected 4.7.32 to before 4.7.32.18Affected 4.7.33 to before 4.7.33.16Affected 4.7.35 to before 4.7.35.15Affected 4.7.39 to before 4.7.39.12Affected 4.7.51 to before 4.7.51.8Affected 4.8.3 to before 4.8.3.10Affected 4.8.9 to before 4.8.9.16Affected 4.8.12 to before 4.8.12.8Affected 4.8.13 to before 4.8.13.9Affected 4.8.24 to before 4.8.24.6Affected 4.8.32 to before 4.8.32.4Affected 4.8.36 to before 4.8.36.2Affected 4.8.43 to before 4.8.43.2Affected 4.8.43 to before 4.8.43.4Affected 4.8.50 to before 4.8.50.1Affected 4.8.50 to before 4.8.50.3Affected x and laterNot affected
WSO2 Carbon Registry Search UIWSO2	4.7.24 to before 4.7.24.11Affected 4.7.32 to before 4.7.32.16Affected 4.7.32 to before 4.7.32.18Affected 4.7.33 to before 4.7.33.16Affected 4.7.35 to before 4.7.35.15Affected 4.7.39 to before 4.7.39.12Affected 4.7.51 to before 4.7.51.8Affected 4.8.3 to before 4.8.3.10Affected 4.8.9 to before 4.8.9.16Affected 4.8.12 to before 4.8.12.8Affected 4.8.13 to before 4.8.13.9Affected 4.8.24 to before 4.8.24.6Affected x and laterNot affected
WSO2 Stratos User Interface For Tenant CRUD OperationsWSO2	4.8.1 to before 4.8.1.6Affected 4.8.7 to before 4.8.7.3Affected 4.9.8 to before 4.9.8.7Affected 4.9.10 to before 4.9.10.7Affected 4.9.10 to before 4.9.10.8Affected 4.9.20 to before 4.9.20.5Affected 4.9.27 to before 4.9.27.1Affected 4.9.31 to before 4.9.31.1Affected 4.9.34 to before 4.9.34.1Affected 4.9.42 to before 4.9.42.1Affected 4.11.0 to before 4.11.0.7Affected 4.11.19 to before 4.11.19.4Affected 4.11.34 to before 4.11.34.3Affected 4.11.45 to before 4.11.45.1Affected x and laterNot affected
WSO2 Stratos SSO Redirector UI ComponentWSO2	4.8.1 to before 4.8.1.6Affected x and laterNot affected
WSO2 Carbon Email Verification UIWSO2	4.7.19 to before 4.7.19.14Affected x and laterNot affected
WSO2 Carbon Event Simulator UIWSO2	2.2.11 to before 2.2.11.1Affected 2.2.14 to before 2.2.14.11Affected 2.2.14 to before 2.2.14.12Affected 2.2.17 to before 2.2.17.5Affected 2.3.1 to before 2.3.1.4Affected 2.3.5 to before 2.3.5.6Affected x and laterNot affected
WSO2 Carbon Execution Manager UIWSO2	5.2.24 to before 5.2.24.10Affected 5.2.26 to before 5.2.26.22Affected 5.2.34 to before 5.2.34.12Affected 5.2.41 to before 5.2.41.7Affected 5.2.57 to before 5.2.57.10Affected 5.3.5 to before 5.3.5.9Affected x and laterNot affected
WSO2 Carbon Governance Custom Lifecycle Checklist UIWSO2	4.8.14 to before 4.8.14.4Affected 4.8.19 to before 4.8.19.8Affected 4.8.21 to before 4.8.21.10Affected 4.8.28 to before 4.8.28.4Affected 4.8.30 to before 4.8.30.6Affected 4.8.32 to before 4.8.32.4Affected x and laterNot affected
WSO2 Carbon Governance Generic Artifact User InterfaceWSO2	4.8.14 to before 4.8.14.4Affected 4.8.19 to before 4.8.19.8Affected 4.8.21 to before 4.8.21.10Affected 4.8.28 to before 4.8.28.4Affected 4.8.30 to before 4.8.30.6Affected 4.8.32 to before 4.8.32.4Affected 4.8.33 to before 4.8.33.4Affected 4.8.34 to before 4.8.34.5Affected 4.8.37 to before 4.8.37.4Affected x and laterNot affected
WSO2 Carbon Governance Life Cycles User InterfaceWSO2	4.8.14 to before 4.8.14.4Affected 4.8.19 to before 4.8.19.8Affected 4.8.21 to before 4.8.21.10Affected 4.8.28 to before 4.8.28.4Affected 4.8.30 to before 4.8.30.6Affected 4.8.32 to before 4.8.32.4Affected x and laterNot affected
WSO2 Carbon Governance WSDL Tool UIWSO2	4.8.14 to before 4.8.14.4Affected 4.8.19 to before 4.8.19.8Affected 4.8.21 to before 4.8.21.10Affected 4.8.28 to before 4.8.28.4Affected 4.8.30 to before 4.8.30.6Affected 4.8.32 to before 4.8.32.4Affected 4.8.33 to before 4.8.33.4Affected 4.8.34 to before 4.8.34.5Affected 4.8.37 to before 4.8.37.4Affected x and laterNot affected
WSO2 Carbon New Data Sources UIWSO2	4.7.19 to before 4.7.19.13Affected 4.7.24 to before 4.7.24.5Affected 4.7.32 to before 4.7.32.10Affected 4.7.35 to before 4.7.35.13Affected 4.7.49 to before 4.7.49.7Affected 4.7.52 to before 4.7.52.5Affected 4.9.2 to before 4.9.2.8Affected 4.9.11 to before 4.9.11.2Affected 4.9.18 to before 4.9.18.1Affected x and laterNot affected
WSO2 Carbon Registry Info UI2WSO2	4.7.32 to before 4.7.32.16Affected 4.7.35 to before 4.7.35.15Affected 4.7.39 to before 4.7.39.12Affected 4.7.51 to before 4.7.51.8Affected 4.8.3 to before 4.8.3.10Affected 4.8.13 to before 4.8.13.9Affected 4.8.32 to before 4.8.32.4Affected 4.8.36 to before 4.8.36.2Affected 4.8.43 to before 4.8.43.2Affected 4.8.50 to before 4.8.50.1Affected x and laterNot affected
WSO2 Carbon Registry Relations UIWSO2	4.7.24 to before 4.7.24.11Affected 4.7.32 to before 4.7.32.16Affected 4.7.35 to before 4.7.35.15Affected 4.7.39 to before 4.7.39.12Affected 4.7.51 to before 4.7.51.8Affected 4.8.3 to before 4.8.3.10Affected 4.8.13 to before 4.8.13.9Affected 4.8.32 to before 4.8.32.4Affected 4.8.36 to before 4.8.36.2Affected 4.8.43 to before 4.8.43.2Affected 4.8.50 to before 4.8.50.1Affected x and laterNot affected
WSO2 Carbon Registry IndexingWSO2	4.7 to before 4.7.24Affected x and laterNot affected
WSO2 Carbon Security UIWSO2	5.14 to before 5.14.127Affected x and laterNot affected
WSO2 Carbon Component Andes Event UIWSO2	3.3.12 to before 3.3.12.3Affected x and laterNot affected
WSO2 Carbon Component Andes UI1WSO2	3.3.12 to before 3.3.12.3Affected x and laterNot affected
WSO2 Carbon HL7 Business Messaging Store UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Endpoint Editor UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Publish Event Mediator Configuration UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Eventing UIWSO2	4.7.19 to before 4.7.19.13Affected x and laterNot affected
WSO2 Carbon HumanTask UIWSO2	4.5.27 to before 4.5.27.10Affected x and laterNot affected
WSO2 Carbon Logging UIWSO2	4.7.19 to before 4.7.19.13Affected 4.7.24 to before 4.7.24.5Affected 4.7.32 to before 4.7.32.10Affected 4.7.52 to before 4.7.52.5Affected x and laterNot affected
WSO2 Carbon Template Editor UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Command Mediator UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Rule Mediator UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Throttle Mediator UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Tasks CoreWSO2	4.7.19 to before 4.7.19.13Affected x and laterNot affected
WSO2 Carbon Rest API Admin UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Sequence Editor UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon Task UIWSO2	4.7.30 to before 4.7.30.53Affected x and laterNot affected
WSO2 Carbon GovernanceWSO2	4.8.37 to before 4.8.37.4Affected x and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.