Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-9312

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP serv
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:4727ba85d9b31817c1d9733091e5cb09aee887a2711e9c7b0459aa271c2fc238
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 10 assertions

{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.auth.service","product":"org.wso2.carbon.identity.auth.service","vendor":"WSO2","versions":[{"lessThan":"1.1.1.2","status":"affected","version":"1.1.1","versionType":"custom"},{"lessThan":"1.1.16.3","status":"affected","version":"1.1.16","versionType":"custom"},{"lessThan":"1.1.18.4","status":"affected","version":"1.1.18","versionType":"custom"},{"lessThan":"1.1.20.5","status":"affected","version":"1.1.20","versionType":"custom"},{"lessThan":"1.1.26.7","status":"affected","version":"1.1.26","versionType":"custom"},{"lessThan":"…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/9

{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.20","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/2

{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.33","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.34","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.0.33","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.37","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.5.0.51","status":"affected","version":"5.5.0","versionType":"custom"},{"lessT…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/5

{"defaultStatus":"unaffected","product":"WSO2 Open Banking KM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.132","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.122","status":"affected","version":"1.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/6

{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.2.0.58","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.84","status":"affected","version":"2.5.0","versionType":"custom"},{"lessThan":"2.6.0.145","status":"affected","version":"2.6.0","versionType":"custom"},{"lessThan":"3.0.0.175","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.1.0.339","status":"affected","version":"3.1.0","versionType":"custom"},{"lessTh…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.138","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.139","status":"affected","version":"1.5.0","versionType":"custom"},{"lessThan":"2.0.0.388","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/7

{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0.408","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/8

{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.3.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.3.0.39","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.52","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.74","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.124","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.9.0.175","status":"affected","version":"5.9.0","versionType":…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/4

{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.20","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/3

Affected products and versions

10 source assertions
{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.auth.service","product":"org.wso2.carbon.identity.auth.service","vendor":"WSO2","versions":[{"lessThan":"1.1.1.2","status":"affected","version":"1.1.1","versionType":"custom"},{"lessThan":"1.1.16.3","status":"affected","version":"1.1.16","versionType":"custom"},{"lessThan":"1.1.18.4","status":"affected","version":"1.1.18","versionType":"custom"},{"lessThan":"1.1.20.5","status":"affected","version":"1.1.20","versionType":"custom"},{"lessThan":"1.1.26.7","status":"affected","version":"1.1.26","versionType":"custom"},{"lessThan":"…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/9
{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.20","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/2
{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.33","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.34","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.0.33","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.37","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.5.0.51","status":"affected","version":"5.5.0","versionType":"custom"},{"lessT…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/5
{"defaultStatus":"unaffected","product":"WSO2 Open Banking KM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.132","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.122","status":"affected","version":"1.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/6
{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.2.0.58","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.84","status":"affected","version":"2.5.0","versionType":"custom"},{"lessThan":"2.6.0.145","status":"affected","version":"2.6.0","versionType":"custom"},{"lessThan":"3.0.0.175","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.1.0.339","status":"affected","version":"3.1.0","versionType":"custom"},{"lessTh…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.138","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.139","status":"affected","version":"1.5.0","versionType":"custom"},{"lessThan":"2.0.0.388","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/7
{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0.408","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/8
{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.3.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.3.0.39","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.52","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.74","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.124","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.9.0.175","status":"affected","version":"5.9.0","versionType":…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/4
{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.20","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/affected/3

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:95a2ae901a518c764ef86de70c6fa7a208a99eb4a1e2b5e5d583df471b600dda · sha256:13528649490aa791… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer