Riskcovery

CVE-2025-14260

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

State
Published
Severity
8.3 High
Published
Oct 28, 2026
Updated
Oct 29, 2026
Reserved
Dec 8, 2025

Read the record on cve.org

Description

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.

Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.

Scores

CVSSScoreVectorSource
3.18.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LWSO2

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.354Affected
  • 3.2.0 to before 3.2.0.458Affected
  • 3.2.1 to before 3.2.1.99Affected
  • 4.0.0 to before 4.0.0.379Affected
  • 4.1.0 to before 4.1.0.265Affected
  • 4.2.0 to before 4.2.0.205Affected
  • 4.3.0 to before 4.3.0.115Affected
  • 4.4.0 to before 4.4.0.79Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.374Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.403Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.423Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.383Affected
  • 5.11.0 to before 5.11.0.430Affected
  • 6.0.0 to before 6.0.0.256Affected
  • 6.1.0 to before 6.1.0.257Affected
  • 7.0.0 to before 7.0.0.134Affected
SAML2 SSO Authenticator UI BundleWSO2
  • 5.5.0 to before 5.5.0.2Affected
  • 5.5.2 to before 5.5.2.5Affected
  • 5.5.9 to before 5.5.9.4Affected
  • 5.5.10 to before 5.5.10.1Affected
  • 5.6.4 to before 5.6.4.1Affected
  • 5.7.2 to before 5.7.2.1Affected
  • 5.8.3 to before 5.8.3.1Affected
  • 5.8.7 to before 5.8.7.2Affected
  • 5.9.4 to before 5.9.4.2Affected
  • 5.9.9 and laterNot affected
WSO2 Carbon UIWSO2
  • 4.6.0 to before 4.6.0.2300Affected
  • 4.6.1 to before 4.6.1.165Affected
  • 4.6.3 to before 4.6.3.46Affected
  • 4.6.4 to before 4.6.4.28Affected
  • 4.7.1 to before 4.7.1.79Affected
  • 4.8.1 to before 4.8.1.50Affected
  • 4.9.0 to before 4.9.0.107Affected
  • 4.9.26 to before 4.9.26.37Affected
  • 4.9.27 to before 4.9.27.24Affected
  • 4.10.9 to before 4.10.9.77Affected
  • 4.10.42 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.