en
WSO2 is a global software company that provides open-source and SaaS platforms for API management, enterprise integration, identity and access management, software engineering, and AI-enabled digital systems. Its technologies are intended for enterprises and public-sector organizations and can be deployed in cloud, on-premises, or hybrid environments.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, WSO2 recorded 42 security vulnerabilities in the last 90 days across 66 products, including 10 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, WSO2 API Manager had the most security vulnerabilities in the WSO2 ecosystem, with 30 vulnerabilities—approximately 71.43% of the provider's total vulnerabilities during this period.
CVE-2024-6423Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageCVE-2025-0326Improper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessCVE-2024-7478Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-5563Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksCVE-2024-4989Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks167 Results | Page 1 of 17
| SeverityUnknown |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityLow |
| SeverityMedium |
| SeverityMedium |