All vulnerabilities
CVE-2025-14260

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.1.0.354Also 3.2.0.458, 3.2.1.99 and 32 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

Show all 35 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.

Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.

Text from CVE List

Affected versions 42

  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.354CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.458CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.99CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.379CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.265CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.205CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.115CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.79CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.374CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.403CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.423CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.383CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.430CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.256CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.257CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.134CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.5.0 before 5.5.0.2CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.5.2 before 5.5.2.5CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.5.9 before 5.5.9.4CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.5.10 before 5.5.10.1CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.6.4 before 5.6.4.1CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.7.2 before 5.7.2.1CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.8.3 before 5.8.3.1CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.8.7 before 5.8.7.2CVE List
  • SAML2 SSO Authenticator UI Bundleaffected: 5.9.4 before 5.9.4.2CVE List
  • SAML2 SSO Authenticator UI Bundleunaffected: 5.9.9CVE List
  • WSO2 Carbon UIaffected: 4.6.0 before 4.6.0.2300CVE List
  • WSO2 Carbon UIaffected: 4.6.1 before 4.6.1.165CVE List
  • WSO2 Carbon UIaffected: 4.6.3 before 4.6.3.46CVE List
  • WSO2 Carbon UIaffected: 4.6.4 before 4.6.4.28CVE List
  • WSO2 Carbon UIaffected: 4.7.1 before 4.7.1.79CVE List
  • WSO2 Carbon UIaffected: 4.8.1 before 4.8.1.50CVE List
  • WSO2 Carbon UIaffected: 4.9.0 before 4.9.0.107CVE List
  • WSO2 Carbon UIaffected: 4.9.26 before 4.9.26.37CVE List
  • WSO2 Carbon UIaffected: 4.9.27 before 4.9.27.24CVE List
  • WSO2 Carbon UIaffected: 4.10.9 before 4.10.9.77CVE List
  • WSO2 Carbon UIunaffected: 4.10.42CVE List

References 1