Description
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Metrics
CVSS 3.1 5.4/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Open Banking AM | >= 2.0.0, < 2.0.0.383 |
| WSO2 | WSO2 API Manager | >= 3.0.0, < 3.0.0.160; >= 3.1.0, < 3.1.0.335; >= 3.2.0, < 3.2.0.432; >= 3.2.1, < 3.2.1.51; >= 4.0.0, < 4.0.0.310; >= 4.1.0, < 4.1.0.208; >= 4.2.0, < 4.2.0.146; >= 4.3.0, < 4.3.0.59 |
| WSO2 | WSO2 Identity Server as Key Manager | >= 5.9.0, < 5.9.0.163; >= 5.10.0, < 5.10.0.355 |
| WSO2 | WSO2 Open Banking IAM | >= 2.0.0, < 2.0.0.404 |
| WSO2 | WSO2 Enterprise Integrator | >= 6.6.0, < 6.6.0.212 |
| WSO2 | WSO2 Identity Server | >= 5.9.0, < 5.9.0.154; >= 5.10.0, < 5.10.0.291; >= 5.11.0, < 5.11.0.371; >= 6.0.0, < 6.0.0.178; >= 6.1.0, < 6.1.0.134 |
| WSO2 | WSO2 Carbon Registry Kernel | >= 4.5.1, < 4.5.1.36; >= 4.5.3, < 4.5.3.36; >= 4.6.0, < 4.6.0.139; >= 4.6.0, < 4.6.0.1544; >= 4.6.1, < 4.6.1.105; >= 4.6.2, < 4.6.2.321; >= 4.6.3, < 4.6.3.28; >= 4.6.4, < 4.6.4.11; >= 4.7.1, < 4.7.1.47; >= 4.8.1, < 4.8.1.27; >= 4.8.1, < 4.8.1.31; >= 4.9.0, < 4.9.0.46; >= 4.9.26, < 4.9.26.18 |
References
Timeline
- Published
- Nov 2, 2026
- Last modified
- Nov 9, 2026
- NVD status
- Awaiting Analysis