CVE-2024-1440 Details
Description
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
A open redirection vulnerability has been identified in multiple WSO2 products, including WSO2 API Manager versions 4.0.0, 3.2.0, and 3.1.0, as well as WSO2 Identity Server versions 7.0.0, 6.1.0, 6.0.0, 5.11.0, and 5.10.0. The vulnerability arises from improper validation of multi-option URLs in the authentication endpoint when multi-option authentication is enabled. This flaw allows malicious actors to craft links that redirect users to attacker-controlled sites, potentially leading to phishing attacks that could harvest sensitive information or facilitate other harmful actions.
Users can migrate to the latest version of the affected WSO2 product to receive security fixes. WSO2 customers with a Support Subscription should use WSO2 Updates to apply the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171/ | WSO2 LLC | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | WSO2 LLC |
Affected Products
| Product | Versions |
|---|---|
| wso2 api manager | 3.1.0 3.2.0 4.0.0 |
CPE
Remediation
| |
| wso2 identity server | 5.10.0 5.11.0 6.0.0 6.1.0 7.0.0 |
CPE
Remediation
| |
| wso2 identity server as key manager | 5.10.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | WSO2 LLC |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 6, 2025 | Initial Analysis | [email protected] |
| Jun 2, 2025 | New CVE Received | WSO2 LLC |