WSO2 API Manager and Identity Server: Server-Side Request Forgery
Summary
Several WSO2 products, including API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM/IAM and the SAML2 SSO Authenticator UI Bundle, contain a Server-Side Request Forgery (SSRF) flaw caused by missing access control and input validation. An attacker can make the server send requests to arbitrary internal or external network locations and access resources reachable by the product, which may expose sensitive data and systems. The CVSS vector requires low privileges (PR:L), while the CVE description says the flaw can be exploited without authentication; WSO2 has not yet resolved this conflict, so internet-facing systems should be treated as the worst case. CISA SSVC rates exploitation as none, and no public exploit is known.
Affected
- WSO2 API Manager: below 3.1.0; 3.1.0 to below 3.1.0.354; 3.2.0 to below 3.2.0.458; 3.2.1 to below 3.2.1.99; 4.0.0 to below 4.0.0.379; 4.1.0 to below 4.1.0.265; 4.2.0 to below 4.2.0.205; 4.3.0 to below 4.3.0.115; 4.4.0 to below 4.4.0.79
- WSO2 Identity Server: below 5.10.0; 5.10.0 to below 5.10.0.383; 5.11.0 to below 5.11.0.430; 6.0.0 to below 6.0.0.256; 6.1.0 to below 6.1.0.257; 7.0.0 to below 7.0.0.134
- WSO2 Identity Server as Key Manager: 5.10.0 to below 5.10.0.374
- WSO2 Open Banking AM: 2.0.0 to below 2.0.0.403
- WSO2 Open Banking IAM: 2.0.0 to below 2.0.0.423
- WSO2 SAML2 SSO Authenticator UI Bundle: several 5.5.x to 5.9.x builds (see advisory)
- WSO2 Carbon UI: listed in the CVE record only, status unconfirmed
Fixed in
- WSO2 API Manager 4.4.0 update level 79, 4.3.0 update level 115, 4.2.0 update level 205, 4.1.0 update level 265, 4.0.0 update level 379, 3.2.1 update level 99, 3.2.0 update level 458, 3.1.0 update level 354
- WSO2 Identity Server 7.0.0 update level 134, 6.1.0 update level 257, 6.0.0 update level 256, 5.11.0 update level 430, 5.10.0 update level 383
- WSO2 Identity Server as Key Manager 5.10.0 update level 374
- WSO2 Open Banking AM 2.0.0 update level 403
- WSO2 Open Banking IAM 2.0.0 update level 423
- Community users: fixes via the linked GitHub pull requests or migration to the latest unaffected version
Workaround
Unknown.
- Restrict outbound connections from WSO2 servers to only the destinations required for operation (general SSRF hardening, not a WSO2 fix).
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public exploit code found in Metasploit or Exploit-DB as of the last check; VulDB states that no public exploit is available.
- No known exploitation in the wild found; check the CISA KEV catalog directly.
- EPSS: 0.28 % (percentile 20).
Our recommendation
- Check whether any WSO2 product listed above is in use and confirm the exact version and update level.
- Check whether the system is reachable from the internet and whether low-privilege accounts or self-registration are possible.
- Apply the fixed update level for the product branch in use, or migrate to an unaffected version.
- Restrict outbound connections from WSO2 servers and monitor for unusual outbound requests.
- If Carbon UI or Business Process Server is in use, ask WSO2 for confirmation or a remediation path, and plan isolation or replacement if none is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WSO2 Security Advisory WSO2-2025-4050 security.docs.wso2.com
- WSO2 docs-security pull request 269 github.com
- VulDB CVE-2025-14260 vuldb.com
- VulDB vulnerability 428187 vuldb.com
- Strix CVE-2025-14260 www.strix.ai
- OffSeq CVE-2025-14260 radar.offseq.com
- threatint CVE-2025-14260 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:05.
Original description (NVD)
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.