CVE-2025-14260

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/

Configurations

No configuration.

History

28 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 20:17

Updated : 2026-10-29 16:08

NVD link : CVE-2025-14260

Mitre link : CVE-2025-14260

CVE.ORG link : CVE-2025-14260

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-14260", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14260", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T01:52:09.688697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.354", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.458", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.99", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.379", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.265", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.205", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.115", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.79", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.374", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.403", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.423", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.383", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.430", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.256", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.257", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.134", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "SAML2 SSO Authenticator UI Bundle", "versions": [{"status": "affected", "version": "5.5.0", "lessThan": "5.5.0.2", "versionType": "custom"}, {"status": "affected", "version": "5.5.2", "lessThan": "5.5.2.5", "versionType": "custom"}, {"status": "affected", "version": "5.5.9", "lessThan": "5.5.9.4", "versionType": "custom"}, {"status": "affected", "version": "5.5.10", "lessThan": "5.5.10.1", "versionType": "custom"}, {"status": "affected", "version": "5.6.4", "lessThan": "5.6.4.1", "versionType": "custom"}, {"status": "affected", "version": "5.7.2", "lessThan": "5.7.2.1", "versionType": "custom"}, {"status": "affected", "version": "5.8.3", "lessThan": "5.8.3.1", "versionType": "custom"}, {"status": "affected", "version": "5.8.7", "lessThan": "5.8.7.2", "versionType": "custom"}, {"status": "affected", "version": "5.9.4", "lessThan": "5.9.4.2", "versionType": "custom"}, {"status": "unaffected", "version": "5.9.9", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon UI", "versions": [{"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.2300", "versionType": "custom"}, {"status": "affected", "version": "4.6.1", "lessThan": "4.6.1.165", "versionType": "custom"}, {"status": "affected", "version": "4.6.3", "lessThan": "4.6.3.46", "versionType": "custom"}, {"status": "affected", "version": "4.6.4", "lessThan": "4.6.4.28", "versionType": "custom"}, {"status": "affected", "version": "4.7.1", "lessThan": "4.7.1.79", "versionType": "custom"}, {"status": "affected", "version": "4.8.1", "lessThan": "4.8.1.50", "versionType": "custom"}, {"status": "affected", "version": "4.9.0", "lessThan": "4.9.0.107", "versionType": "custom"}, {"status": "affected", "version": "4.9.26", "lessThan": "4.9.26.37", "versionType": "custom"}, {"status": "affected", "version": "4.9.27", "lessThan": "4.9.27.24", "versionType": "custom"}, {"status": "affected", "version": "4.10.9", "lessThan": "4.10.9.77", "versionType": "custom"}, {"status": "unaffected", "version": "4.10.42", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon:org.wso2.carbon.ui", "defaultStatus": "unknown"}]}], "published": "2026-10-28T20:17:14.790", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.\n\nExploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems."}], "lastModified": "2026-10-29T16:08:42.827", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}