Wso2 Wso2 Carbon Identity Application Authentication Framework
5 CVEs affecting Wso2 Wso2 Carbon Identity Application Authentication Framework. Latest disclosed: 2026-10-19. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |
CVE-2023-6837 | High | 8.5 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any imp… |
CVE-2025-5802 | Medium | 5.3 | 2026-09-15 | The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts t… |
CVE-2025-13909 | Medium | 4.3 | 2026-08-06 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-fact… |
CVE-2024-4412 | Low | 2.7 | 2026-10-19 | The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to… |