Information Disclosure Vulnerability in WSO2 Products
CVE-2025-13647

5.8MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Wso2 Open Banking Iam
Wso2 Identity Server As Key Manager
Wso2 Identity Server Keystore Rest Api Commons
Vendor
CVE Published:
2 November 2026

What is CVE-2025-13647?

The vulnerability arises from the affected component's failure to enforce strict validation of the content-type header when handling incoming requests. This oversight allows attackers to craft malicious requests with altered content-type headers, potentially leading to unauthorized exposure of sensitive file paths for certificate files. Such information disclosure can be exploited, impacting the confidentiality of the system and paving the way for future attacks.

Affected Version(s)

WSO2 Identity Server 5.10.0 < 5.10.0.381

WSO2 Identity Server 5.11.0 < 5.11.0.428

WSO2 Identity Server 6.0.0 < 6.0.0.255

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.