- Top reward
- $500
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 83
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Paid by PayPal, Amazon voucher
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$500 |
| High |
|
$250 |
| Medium |
|
$100 |
| Low |
|
$50 |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 9 excluded.
Web 1
- https://wso2.com/api-manager
Products and areas 7
- The carbon-apimgt core libraries and the Carbon runtime underneath them, including the management console, the registry and the user-store and role plumbing
- The Key Manager, covering OAuth2 and OIDC token issuance, introspection, key generation, scope enforcement and the identity flows API Manager runs on top of
- The programme fixes the testing target rather than the bug class: any security issue you can demonstrate on a WSO2 build running on infrastructure you control, on a deployment you own, or in your own tenant of a WSO2 cloud service
- The Publisher, Developer Portal and Admin Portal applications, together with the publisher, devportal, admin and service-catalogue REST APIs behind them
- The Synapse-based API Gateway data plane in full: mediation sequences, message transformation, XML and JSON payload handling, the throttling and Traffic Manager path, and the gateway's own caches
- The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. API Manager is the API Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution, wso2/product-apim on top of wso2/carbon-apimgt
- What a stock deployment exposes on top of that: multi-tenant isolation, API and application lifecycle operations, subscription and key management, and the tooling shipped in the distribution
Out of scope (9)
- Any customer-owned deployment of WSO2 software: the target is your own instance or your own tenant, and somebody else's installation is out of bounds
- Duplicates: only the first reporter of an issue is paid
- Findings that need administrative credentials you were handed, or a configuration you weakened yourself, to reach at all
- Network-level and volumetric denial of service against WSO2 services
- Out-of-date bundled libraries with no working exploit against the shipped product, and any report without a working proof of concept
- Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own
- Third-party assets and non-WSO2 domains, which belong to whoever runs them
- Versions at or below 2.1.0, which the repository's supported-versions table places outside support
- WSO2-operated websites such as wso2.com, internal staging environments and demo sites, all named out of scope by the programme
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Test only against a self-hosted WSO2 build on infrastructure you control, a deployment you own, or your own tenant in a WSO2 cloud service: never against a WSO2-operated site or somebody else's installation
-
Versions at or below 2.1.0 are unsupported per the repository's supported-versions table, so a finding that only reproduces there is not eligible
-
Include a working proof of concept, and do not rely on administrative credentials you were handed to reach the bug
Not accepted
-
Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own
-
Out-of-date bundled libraries with no working exploit against the shipped product, and any report without a working proof of concept
-
Findings that need administrative credentials you were handed, or a configuration you weakened yourself, to reach at all
-
Duplicates: only the first reporter of an issue is paid
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-12737 | The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative | High 8.4 | 3 Sep 2026 |
| CVE-2026-3416 | The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's auth | Medium 5.9 | 3 Sep 2026 |
| CVE-2026-5430 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of admi | Critical 10.0 | 6 Aug 2026 |
| CVE-2026-1728 | Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able t | Critical 9.8 | 6 Aug 2026 |
| CVE-2025-13736 | When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, soci | Low 3.7 | 6 Aug 2026 |
| CVE-2025-13909 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of u | Medium 4.3 | 6 Aug 2026 |
| CVE-2025-14779 | The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, pot | Low 3.8 | 6 Aug 2026 |
| CVE-2025-15039 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful e | Critical 9.4 | 6 Aug 2026 |
| CVE-2026-0637 | When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs. An attacker | Medium 5.4 | 6 Aug 2026 |
| CVE-2024-6832 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism | Medium 5.9 | 6 Aug 2026 |
| CVE-2024-8995 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of us | Medium 4.9 | 6 Aug 2026 |
| CVE-2025-11850 | When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values | Medium 4.3 | 6 Aug 2026 |
| CVE-2025-12627 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token | Low 2.4 | 6 Aug 2026 |
| CVE-2025-13394 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, incl | Medium 5.4 | 6 Aug 2026 |
| CVE-2024-10302 | The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of th | Medium 4.0 | 6 Aug 2026 |
| CVE-2026-2445 | The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve | Medium 6.1 | 20 Jul 2026 |
| CVE-2026-4249 | The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API | High 8.6 | 6 Jul 2026 |
| CVE-2025-8591 | The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve in | Medium 6.1 | 6 Jul 2026 |
| CVE-2024-1248 | The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) wi | Medium 4.8 | 4 Jul 2026 |
| CVE-2025-13475 | In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of use | Low 3.5 | 4 Jul 2026 |
| CVE-2026-2053 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of serv | High 8.3 | 26 Jun 2026 |
| CVE-2025-10470 | The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth. This vulnerability can result in a denial-of-service condition, causing service unavailability for deployments that utilize the Magic Link authenticator. The impact is limited to these specific deployments and requires | High 8.6 | 11 May 2026 |
| CVE-2025-9973 | Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizati | Medium 6.4 | 11 May 2026 |
| CVE-2025-10908 | Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been | High 7.3 | 11 May 2026 |
| CVE-2025-8154 | In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, a | Medium 5.3 | 11 May 2026 |
| CVE-2025-8325 | The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive | Medium 6.3 | 11 May 2026 |
| CVE-2024-0391 | The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to craft targeted phishing campaigns or other malicious activities aimed at tricking u | Medium 5.3 | 11 May 2026 |
| CVE-2025-10503 | The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, r | Medium 6.1 | 29 Apr 2026 |
| CVE-2025-12624 | Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts. The security consequence is that a locked user account can maintain access to protected resources through the use of existi | Medium 6.0 | 16 Apr 2026 |
| CVE-2024-4867 | The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, mak | Medium 5.4 | 16 Apr 2026 |
| CVE-2024-8010 | The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the | Low 3.5 | 16 Apr 2026 |
| CVE-2025-6024 | The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browse | Medium 6.1 | 16 Apr 2026 |
| CVE-2024-10242 | The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve | Medium 6.1 | 16 Apr 2026 |
| CVE-2024-2374 | The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and acce | High 7.5 | 16 Apr 2026 |
| CVE-2024-1524 | When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when a | High 7.7 | 24 Feb 2026 |
| CVE-2025-13590 | A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload. | Critical 9.1 | 19 Feb 2026 |
| CVE-2025-12107 | The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to sign | High 8.4 | 19 Feb 2026 |
| CVE-2025-9312 | A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on th | Critical 9.8 | 18 Nov 2025 |
| CVE-2025-6670 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level | High 8.8 | 18 Nov 2025 |
| CVE-2025-10853 | A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browse | Medium 5.2 | 5 Nov 2025 |
| CVE-2025-5770 | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or | Medium 6.1 | 5 Nov 2025 |
| CVE-2025-11093 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise In | High 8.4 | 5 Nov 2025 |
| CVE-2025-10907 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the | High 8.4 | 5 Nov 2025 |
| CVE-2025-10713 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service | Medium 6.5 | 5 Nov 2025 |
| CVE-2025-3125 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefo | Medium 6.7 | 5 Nov 2025 |
| CVE-2025-5350 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS | Medium 5.9 | 24 Oct 2025 |
| CVE-2025-5605 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full ac | Medium 4.3 | 24 Oct 2025 |
| CVE-2025-9152 | An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations. | Critical 9.8 | 16 Oct 2025 |
| CVE-2025-9804 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WS | Critical 9.6 | 16 Oct 2025 |
| CVE-2025-9955 | An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user inform | Medium 5.7 | 16 Oct 2025 |
| CVE-2025-10611 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations. | Critical 9.8 | 16 Oct 2025 |
| CVE-2025-1862 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code | Medium 6.7 | 26 Sep 2025 |
| CVE-2025-1396 | A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the applicatio | Low 3.7 | 26 Sep 2025 |
| CVE-2025-0672 | An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device. This flaw may allow a previously d | Low 3.3 | 23 Sep 2025 |
| CVE-2025-0209 | A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser. This vulnerability could allow attackers to redirect use | Medium 6.1 | 23 Sep 2025 |
| CVE-2025-0663 | A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants. Because the Auto-Login feature is enabled by default, this flaw may all | Medium 6.8 | 23 Sep 2025 |
| CVE-2024-6429 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks thr | Medium 4.3 | 23 Sep 2025 |
| CVE-2025-5717 | An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerabili | Medium 6.8 | 23 Sep 2025 |
| CVE-2025-4760 | An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could resul | Medium 4.8 | 23 Sep 2025 |
| CVE-2024-4598 | An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user credentials or access tokens but may lead to leakage o | Medium 6.5 | 23 Sep 2025 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (CVSS 9.0-10.0) │ $500 │ $625 High (CVSS 7.0-8.9) │ $250 │ $313 Medium (CVSS 4.0-6.9) │ $100 │ $125 Low (CVSS >0 to 3.9) │ $50 │ $63 Submit a vulnerability CVE history 31 Last 12 months 83 Lifetime Access control 30 % XSS 20 % Injection 20 % Auth bypass 20 % Latest advisories Loading the feed Overview WSO2 API Manager is the most widely deployed fully open-source enterprise API gateway outside the Kong and Apigee axis: an Apache-2.0 Synapse-based data plane in wso2/product-apim , with the shared carbon-apimgt libraries underneath it and an OAuth2/OIDC key manager issuing and validating the tokens every request is checked against. It runs in government digital-identity and open-banking programmes across Europe, Latin America, South Asia and the Gulf, in telco BSS and OSS stacks, and in healthcare integration, deployments that skew regulated, internet-facing and slow to patch, which is exactly the profile in which a gateway authentication bypass matters most, and the reason WSO2 products keep reappearing on CISA's Known Exploited Vulnerabilities catalogue. The defect rate is unusually high for a product of this size: 83 CVEs lifetime and 31 in the last twelve months, which is evidence that the vendor is genuinely assigning identifiers against the open-source distribution rather than quietly sitting on findings. WSO2 pays by CVSS band on its own Reward and Acknowledgement Program, $500 for a Critical down to $50 for a Low, in cash by PayPal or as an Amazon voucher at the reporter's choice. That is an order of magnitude below the big cloud rails in this niche, which is why the uplift matters here: sorona.xyz adds 1.25× on top of whatever WSO2 awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. API Manager is the API Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution, wso2/product-apim on top of wso2/carbon-apimgt The programme fixes the testing target rather than the bug class: any security issue you can demonstrate on a WSO2 build running on infrastructure you control, on a deployment you own, or in your own tenant of a WSO2 cloud service The Synapse-based API Gateway data plane in full: mediation sequences, message transformation, XML and JSON payload handling, the throttling and Traffic Manager path, and the gateway's own caches The Key Manager, covering OAuth2 and OIDC token issuance, introspection, key generation, scope enforcement and the identity flows API Manager runs on top of The Publisher, Developer Portal and Admin Portal applications, together with the publisher, devportal, admin and service-catalogue REST APIs behind them The carbon-apimgt core libraries and the Carbon runtime underneath them, including the management console, the registry and the user-store and role plumbing What a stock deployment exposes on top of that: multi-tenant isolation, API and application lifecycle operations, subscription and key management, and the tooling shipped in the distribution Out of scope WSO2-operated websites such as wso2.com, internal staging environments and demo sites, all named out of scope by the programme Any customer-owned deployment of WSO2 software: the target is your own instance or your own tenant, and somebody else's installation is out of bounds Third-party assets and non-WSO2 domains, which belong to whoever runs them Versions at or below 2.1.0, which the repository's supported-versions table places outside support Network-level and volumetric denial of service against WSO2 services Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own Out-of-date bundled libraries with no working exploit against the shipped product, and any report without a working proof of concept Findings that need administrative credentials you were handed, or a configuration you weakened yourself, to reach at all Duplicates: only the first reporter of an issue is paid Most-valued findings Authentication or authorization bypass at the gateway that reaches a backend API the deployment meant to protect. Access control is the largest recorded class here at roughly thirty per cent, and on an internet-facing gateway fronting a regulated backend it is the finding most likely to grade 9.0 and pay the $500 top rung. Key Manager defects in token issuance, introspection or scope enforcement: a forged, replayed or over-scoped token is an authentication bypass for every API behind the gateway at once rather than for a single route Pre-authentication remote code execution on a stock install, whether through file upload, deserialization or an unauthenticated management endpoint. That is the shape that put WSO2 products on CISA KEV. Injection through mediation: XXE, entity expansion or command and expression injection driven by a request body the gateway parses before it has decided whether the caller is allowed to send it Cross-tenant access in a shared deployment, where the isolation boundary is the only thing separating unrelated organisations on one gateway Stored XSS in the Publisher or Developer Portal that fires in an administrator's session and chains into an API or subscription change, rather than a reflected payload with nothing behind it Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Test only against a self-hosted WSO2 build on infrastructure you control, a deployment you own, or your own tenant in a WSO2 cloud service: never against a WSO2-operated site or somebody else's installation Versions at or below 2.1.0 are unsupported per the repository's supported-versions table, so a finding that only reproduces there is not eligible Include a working proof of concept, and do not rely on administrative credentials you were handed to reach the bug WSO2 grades severity itself and fixes the payout by CVSS band; the reward is released only after the fix is announced, and fixes can take up to 90 days Keep every communication about the report on WSO2's documented channels: public posts that violate responsible disclosure, or that reflect negatively on the programme or the WSO2 brand, disqualify you from reward consideration Disclosure Coordinated with WSO2's security team through [email protected] , the address product-apim 's own SECURITY.md points at. The written restriction asks you not to disclose in any forum, public or private, until WSO2 has completed its vulnerability management process, a bounded embargo rather than an indefinite gag, so sorona.xyz holds your finding until the fix has been announced. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability