WSO2 bug bounty programs
wso2.com Updated
WSO2 runs 4 public programs on Sorona and its own site; 4 pay cash, the most up to $500 (WSO2 Micro Integrator).
- Top reward
- $500
- Sorona
- Programs
- 4
- 4 pay cash
- Targets in scope
- 36
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
4 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
WSO2 Micro Integrator
Sorona · Pays the most of the 4 programs: up to $500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
WSO2 Micro Integrator
Sorona · Bug bounty |
$500 (highest) | $250 (highest) | $100 (highest) | $50 (highest) | $500 | Partial | – | – | Open |
|
WSO2 Identity Server
Sorona · Bug bounty |
$500 | $250 | $100 | $50 | $500 | Partial | – | 7 days promised | Open |
|
WSO2
Self-hosted · Bug bounty |
– | – | – | – | $500 | – | – | – | Open |
|
WSO2 API Manager
Sorona · Bug bounty |
$500 | $250 | $100 | $50 | $500 | Partial | – | – | Open |
-
- Critical
- $500 (highest)
- High
- $250 (highest)
- Medium
- $100 (highest)
- Low
- $50 (highest)
- Safe harbor
- Partial
-
- Critical
- $500
- High
- $250
- Medium
- $100
- Low
- $50
- Safe harbor
- Partial
- First response
- 7 days promised
-
- Critical
- $500
- High
- $250
- Medium
- $100
- Low
- $50
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
36 targets across all 4 programs, each listed once with the programs that cover it. 11 excluded.
-
Account management as the product ships it, covering self-registration, password recovery, account locking, consent handling and the end-user My Account portal
Products and areas
Covered by WSO2 Identity Server
-
Configuration and secret handling: the secure vault, secret resolution, keystores, and the backend credentials the runtime holds for every system behind it
Products and areas
Covered by WSO2 Micro Integrator
-
Connector execution and the data services layer, which reach databases and third-party systems on behalf of a mediation flow
Products and areas
Covered by WSO2 Micro Integrator
-
Every inbound endpoint and transport the runtime listens on, including HTTP and HTTPS, JMS, file and FTP polling, and Kafka
Products and areas
Covered by WSO2 Micro Integrator
-
Identity storage and the code around it: JDBC and LDAP user stores, the identity and claim databases, claim mapping, and keystore and secret handling
Products and areas
Covered by WSO2 Identity Server
-
Multi-tenancy inside a single deployment, plus Identity Server running as the key manager underneath a WSO2 API Manager install, which is how a large share of its installed base actually runs
Products and areas
Covered by WSO2 Identity Server
-
The administrative surface: the Carbon management console, the newer console, the SCIM 2.0 user and group endpoints, and the admin REST and SOAP APIs behind them
Products and areas
Covered by WSO2 Identity Server
-
The carbon-apimgt core libraries and the Carbon runtime underneath them, including the management console, the registry and the user-store and role plumbing
Products and areas
Covered by WSO2 API Manager
-
The Key Manager, covering OAuth2 and OIDC token issuance, introspection, key generation, scope enforcement and the identity flows API Manager runs on top of
Products and areas
Covered by WSO2 API Manager
-
The management API, the MI Dashboard and the command-line tooling, with their authentication, role enforcement and every administrative operation they expose
Products and areas
Covered by WSO2 Micro Integrator
-
The programme fixes the testing target rather than the bug class: any security issue you can demonstrate on a WSO2 build running on infrastructure you control, on a deployment you own, or in your own tenant of a WSO2 cloud service
Products and areas
Covered by WSO2 Micro Integrator, WSO2 API Manager, WSO2 Identity Server
-
The Publisher, Developer Portal and Admin Portal applications, together with the publisher, devportal, admin and service-catalogue REST APIs behind them
Products and areas
Covered by WSO2 API Manager
-
The Synapse-based API Gateway data plane in full: mediation sequences, message transformation, XML and JSON payload handling, the throttling and Traffic Manager path, and the gateway's own caches
Products and areas
Covered by WSO2 API Manager
-
The Synapse-based mediation engine in full: sequences and mediators, message transformation between XML, JSON and the other supported formats, XPath and XSLT evaluation, proxy services, deployed REST APIs, and message stores and processors
Products and areas
Covered by WSO2 Micro Integrator
-
The whole authentication and federation stack: SAML 2.0, OpenID Connect, OAuth 2.0 and WS-Federation, the inbound and outbound connectors, single sign-on and single logout, session handling, and the adaptive and multi-factor authentication paths
Products and areas
Covered by WSO2 Identity Server
-
The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. API Manager is the API Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution, wso2/product-apim on top of wso2/carbon-apimgt
Products and areas
Covered by WSO2 API Manager
-
The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. Identity Server is the Identity Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution wso2/product-is
Products and areas
Covered by WSO2 Identity Server
-
The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. Micro Integrator is the Integration Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution wso2/product-integrator-mi
Products and areas
Covered by WSO2 Micro Integrator
-
What a stock deployment exposes on top of that: multi-tenant isolation, API and application lifecycle operations, subscription and key management, and the tooling shipped in the distribution
Products and areas
Covered by WSO2 API Manager
No target matches. Try part of a host name, such as the company name.
Out of scope 11
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Any customer-owned deployment of WSO2 software: the target is your own instance or your own tenant, and somebody else's installation is out of bounds
WSO2 API Manager WSO2 Identity Server WSO2 Micro Integrator
-
Duplicates: only the first reporter of an issue is paid
WSO2 API Manager WSO2 Identity Server WSO2 Micro Integrator
-
Findings that need administrative credentials you were handed, or a configuration you weakened yourself, to reach at all
WSO2 API Manager
-
Network-level and volumetric denial of service against WSO2 services
WSO2 Identity Server WSO2 API Manager
-
Network-level and volumetric denial of service. Application-level DoS against your own self-hosted instance is the part that stays in scope
WSO2 Micro Integrator
-
Out-of-date bundled libraries with no working exploit against the shipped product, and any report without a working proof of concept
WSO2 Identity Server WSO2 API Manager
-
Out-of-date third-party libraries with no working exploit against the shipped product, and any report without a working proof of concept
WSO2 Micro Integrator
-
Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own
WSO2 Micro Integrator WSO2 Identity Server WSO2 API Manager
-
Third-party assets and non-WSO2 domains, which belong to whoever runs them
WSO2 API Manager WSO2 Identity Server WSO2 Micro Integrator
-
Versions at or below 2.1.0, which the repository's supported-versions table places outside support
WSO2 API Manager
-
WSO2-operated websites such as wso2.com, internal staging environments and demo sites, all named out of scope by the programme
WSO2 Identity Server WSO2 Micro Integrator WSO2 API Manager
Recent changes
Reward and scope changes across every WSO2 program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in WSO2 products, from the NVD.
-
CVE-2025-12737 High
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative
-
CVE-2025-12737 High
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative
-
CVE-2025-12737 High
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative
-
CVE-2025-12737 High
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative
-
CVE-2026-3416 Medium
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's auth
-
CVE-2026-3416 Medium
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's auth
-
CVE-2026-3416 Medium
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's auth
-
CVE-2026-3416 Medium
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's auth
About this page
This page gathers every public program listed under wso2.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.