Security Advisory WSO2-2021-1493¶
Published: 2026-01-26
Version: 1.0.0
Severity: Medium
CVSS Score: 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
AFFECTED PRODUCTS¶
- WSO2 Identity Server: 5.11.0, 5.10.0, 5.9.0, 5.8.0
OVERVIEW¶
Open Redirect vulnerability in account recovery flow.
DESCRIPTION¶
Due to improper URL validation in account recovery flow associated endpoint could facilitate an Open Redirect vulnerability.
IMPACT¶
By using social engineering techniques an attacker could persuade a user to click on a valid link (but with a malicious payload) and get the user redirected to an attacker controlled page where a phishing attack could be executed to obtain highly sensitive information or harm otherwise.
SOLUTION¶
Community Users (Open Source)¶
Migrate to the latest unaffected version of the respective WSO2 product(s).
Support Subscription Holders¶
Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.
Info
WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.
| Product Name | Product Version | Update Level |
|---|---|---|
| WSO2 Identity Server | 5.11.0 | 55 |
| WSO2 Identity Server | 5.10.0 | 62 |
| WSO2 Identity Server | 5.9.0 | 44 |
| WSO2 Identity Server | 5.8.0 | 33 |