WSO2 Identity Server

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (CVSS 9.0-10.0) │ $500 │ $625 High (CVSS 7.0-8.9) │ $250 │ $313 Medium (CVSS 4.0-6.9) │ $100 │ $125 Low (CVSS >0 to 3.9) │ $50 │ $63 Submit a vulnerability CVE history 30 Last 12 months 70 Lifetime Access control 30 % Auth bypass 25 % XSS 20 % Injection 15 % Latest advisories Loading the feed Overview WSO2 Identity Server is the Apache-2.0 identity, single-sign-on and federation server in wso2/product-is , and it is the incumbent open-source IAM product across South and Southeast Asian government and telecom estates plus a long tail of enterprises that standardised before Keycloak existed. It sits underneath several national digital-identity and e-government stacks, and it is bundled into WSO2 API Manager deployments as the key manager, so a great many organisations run it without ever describing themselves as Identity Server users: GitHub stars are close to meaningless as a footprint measure here because adoption arrives through WSO2's commercial distribution rather than through the repo. What a bug costs is already on record: CVE-2022-29464, an unauthenticated arbitrary file upload leading to remote code execution, was exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalogue. WSO2 runs its own Reward and Acknowledgement Program and pays by CVSS band, $500 for a Critical down to $50 for a Low, in cash by PayPal or as an Amazon voucher at the reporter's choice. The ceiling is small enough that the uplift dominates it: sorona.xyz adds 1.25× on top of whatever WSO2 awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The WSO2 Reward and Acknowledgement Program declares five product families in scope: Agent Platform, API Platform, Integration Platform, Identity Platform and Developer Platform. Identity Server is the Identity Platform product, and the build the programme points you at is the self-hosted Apache-2.0 distribution wso2/product-is The programme fixes the testing target rather than the bug class: any security issue you can demonstrate on a WSO2 build running on infrastructure you control, on a deployment you own, or in your own tenant of a WSO2 cloud service The whole authentication and federation stack: SAML 2.0, OpenID Connect, OAuth 2.0 and WS-Federation, the inbound and outbound connectors, single sign-on and single logout, session handling, and the adaptive and multi-factor authentication paths Account management as the product ships it, covering self-registration, password recovery, account locking, consent handling and the end-user My Account portal The administrative surface: the Carbon management console, the newer console, the SCIM 2.0 user and group endpoints, and the admin REST and SOAP APIs behind them Identity storage and the code around it: JDBC and LDAP user stores, the identity and claim databases, claim mapping, and keystore and secret handling Multi-tenancy inside a single deployment, plus Identity Server running as the key manager underneath a WSO2 API Manager install, which is how a large share of its installed base actually runs Out of scope WSO2-operated websites such as wso2.com, internal staging environments and demo sites, all named out of scope by the programme Any customer-owned deployment of WSO2 software: the target is your own instance or your own tenant, and somebody else's installation is out of bounds Third-party assets and non-WSO2 domains, which belong to whoever runs them Network-level and volumetric denial of service against WSO2 services Self-XSS, clickjacking without demonstrated impact, version disclosure, stack traces, missing headers and TLS hardening preferences standing on their own Out-of-date bundled libraries with no working exploit against the shipped product, and any report without a working proof of concept Duplicates: only the first reporter of an issue is paid Most-valued findings Pre-authentication remote code execution on a stock install: arbitrary file upload, unsafe deserialization or an administrative endpoint reachable without a credential. This is the CVE-2022-29464 shape, the reason WSO2 keeps landing in CISA KEV, and the class that reliably grades 9.0 or above and pays the $500 top rung. Authentication bypass in the SAML, OIDC or OAuth 2.0 flows: signature wrapping, assertion or token confusion, or an authorization-code or state check that can be skipped. The whole product exists to answer one question correctly, and this is a quarter of its recorded bug history. Access-control failures that let an ordinary account reach administrative SCIM or management APIs, the single largest recorded class here at roughly thirty per cent Cross-tenant reads or writes in a multi-tenant deployment, where the isolation boundary is the only thing separating unrelated organisations sharing one server Stored XSS in the Carbon console that fires in an administrator's session and chains into a real administrative action, rather than a reflected payload with nothing behind it Injection into a backing LDAP or JDBC user store that reads or alters credentials for accounts the reporter does not control Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Test only against a self-hosted WSO2 build on infrastructure you control, a deployment you own, or your own tenant in a WSO2 cloud service: the programme states this as a requirement rather than a preference Include a working proof of concept; findings without one are excluded regardless of how the bug reads on paper Only the first reporter of an issue is rewarded, so a duplicate earns nothing however good the writeup WSO2 grades severity itself and the reward decision rests with WSO2; payment comes only after the fix is announced, and fixes can take up to 90 days Keep every communication about the report on WSO2's documented channels: public posts that violate responsible disclosure, or that reflect negatively on the programme or the WSO2 brand, disqualify you from reward consideration Disclosure Coordinated with WSO2's security team through [email protected] . WSO2 commits to an initial response within seven days, takes up to 90 days to ship a fix, and releases the reward only once the fix has been announced, so the embargo runs to WSO2's advisory rather than to a fixed clock. The restriction it publishes governs public posting rather than private routing, so sorona.xyz holds your finding until that advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability