Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.

An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

Üreticinin çözüm notu (İngilizce)

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/#solution

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• security.docs.wso2.com/…ements/security-advisories/2026/WSO2-2024-3696 Üretici bülteni

Kayıt geçmişi

1. 2 Kas 2026 15:24Yayımlandı

İlgili açıklar

• 4,9 CVE-2024-9517Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
• 5,4 CVE-2024-2372Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
• 4,4 CVE-2026-18800Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
• 5,8 CVE-2025-13647Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
• 4,6 CVE-2024-7075Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
• 4,8 CVE-2024-5617Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks