CVE-2024-7487 json
Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
published 2025-05-22 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-54573
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed.
Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.
Patch / fix
- WSO2 WSO2 Identity Server 7.0.0.65
- WSO2 Client Attestation Filter 7.0.26.24, 7.0.51
- WSO2 WSO2 Carbon Identity Client Attestation Met Data Mgt BE 7.0.78.44, 7.1.30
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
Affected products
- WSO2 WSO2 Identity Server
- WSO2 Client Attestation Filter
- WSO2 WSO2 Carbon Identity Client Attestation Met Data Mgt BE
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
Sources
- CVE List CVE-2024-7487
- NVD CVE-2024-7487
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.