WSO2 Identity Server vulnerabilities

4 CVEs affecting WSO2 Identity Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-8122, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-8122, published 2026-10-08. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely,…
CVE-2025-5802, published 2026-09-15. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username,…
CVE-2025-12317, published 2026-08-06. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could…
CVE-2025-13166, published 2026-09-15. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation…