vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-1440

Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint

MEDIUM
6.1
CVSS Score
Published: June 2, 2025 at 04:51 PM UTC
Updated: June 17, 2026 at 07:04 AM UTC
6 products affected across 1 vendorAPI ManagerIdentity ServerIdentity Server As Key Manager

Using WSO2 Identity Server by WSO2?

Get instant alerts when new vulnerabilities affect WSO2 Identity Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

API Manager· WSO2
95%
3.1.0 ≤ v < 3.1.0.2623.2.0 ≤ v < 3.2.0.3444.0.0 ≤ v < 4.0.0.2963.1.03.2.04.0.0
Affected range stops below 3.1.0.262, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0.344, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.0.0.296, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 3.1.0 (unknown)
Identity Server· WSO2
95%
5.10.0 ≤ v < 5.10.0.2785.11.0 ≤ v < 5.11.0.3476.0.0 ≤ v < 6.0.0.1856.1.0 ≤ v < 6.1.0.1457.0.0 ≤ v < 7.0.0.305.10.05.11.06.0.06.1.07.0.0
Affected range stops below 5.10.0.278, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.11.0.347, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.0.0.185, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.1.0.145, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.0.0.30, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.10.0 (unknown)
Identity Server As Key Manager· WSO2
95%
5.10.0 ≤ v < 5.10.0.2985.10.0
Affected range stops below 5.10.0.298, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.10.0 (unknown)
Carbon Identity Application Authentication Endpoint· WSO2
60%
5.17.5 ≤ v < 5.17.5.2565.18.187 ≤ v < 5.18.187.2575.23.8 ≤ v < 5.23.8.1745.25.92 ≤ v < 5.25.92.777.0.78 ≤ v < 7.0.78.185.17.55.18.1875.23.85.25.927.0.78
Affected range stops below 5.17.5.256, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.18.187.257, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.23.8.174, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.25.92.77, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 7.0.111 (unaffected)
Affected range stops below 7.0.78.18, so it looks safe — our inference, not a vendor statement
Open Banking Am· WSO2
60%
2.0.0 ≤ v < 2.0.0.3082.0.0
Affected range stops below 2.0.0.308, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.0.0 (unknown)
Open Banking IAM· WSO2
60%
2.0.0 ≤ v < 2.0.0.3272.0.0
Affected range stops below 2.0.0.327, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.0.0 (unknown)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Vendor Advisory
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-601

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card