Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

published 2026-11-02 7 d ago modified 2026-11-09 5 h ago also EUVD-2024-55839

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.

An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 d ago (2026-11-02)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

WSO2 WSO2 Identity Server

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

security.docs.wso2.com /en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/
vendor-advisory

Sources

CVE List CVE-2024-12141
NVD CVE-2024-12141

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary