Open Redirection Vulnerability in WSO2 Identity Server
CVE-2024-2372

5.4MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Open Banking Am
Wso2 Api Manager
Wso2 Identity Server As Key Manager
Wso2 Open Banking Iam
Vendor
CVE Published:
2 November 2026

What is CVE-2024-2372?

This vulnerability affects WSO2 Identity Server, allowing attackers to exploit insufficient input validation mechanisms. By using maliciously crafted URLs, an attacker can redirect users to untrusted external sites, potentially facilitating phishing attempts or other social engineering attacks. This breach of user trust poses a significant risk to sensitive data and organizational integrity, requiring immediate attention to safeguard against exploitation.

Affected Version(s)

WSO2 API Manager 3.0.0 < 3.0.0.160

WSO2 API Manager 3.1.0 < 3.1.0.335

WSO2 API Manager 3.2.0 < 3.2.0.432

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.