CVE-2024-6914

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

At a glance

Severity: CRITICAL 9.8
EPSS: EPSS 0.75 % · percentile 55 (2026-10-27)
State: PUBLISHED
Published: 2025-05-22
Updated: 2025-08-27
Assigner: WSO2
NVD status: Analyzed

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	WSO2
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	WSO2
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Weaknesses (CWE)

CWE-863

European references

ENISA EUVD · EUVD-2024-54595
GCVE · GCVE-0-2024-6914

Affected configurations (NVD CPE)

cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*

Affected products

Product	Versions
WSO2 · WSO2 API Manager	unknown 0 < 2.2.0 ; affected 2.2.0 < 2.2.0.55 ; affected 2.5.0 < 2.5.0.82 ; affected 2.6.0 < 2.6.0.141 ; affected 3.0.0 < 3.0.0.161 ; affected 3.1.0 < 3.1.0.292
WSO2 · WSO2 Governance Registry	affected 5.4.0 < 5.4.0.14
WSO2 · WSO2 Identity Server	unknown 0 < 5.3.0 ; affected 5.3.0 < 5.3.0.31 ; affected 5.4.0 < 5.4.0.30 ; affected 5.4.1 < 5.4.1.35 ; affected 5.5.0 < 5.5.0.48 ; affected 5.6.0 < 5.6.0.56
WSO2 · WSO2 Identity Server as Key Manager	unknown 0 < 5.3.0 ; affected 5.3.0 < 5.3.0.36 ; affected 5.5.0 < 5.5.0.49 ; affected 5.6.0 < 5.6.0.70 ; affected 5.7.0 < 5.7.0.121 ; affected 5.9.0 < 5.9.0.162
WSO2 · WSO2 IoT	affected 3.3.0 < 3.3.0.59 ; affected 3.3.1 < 3.3.1.61
WSO2 · WSO2 Open Banking AM	unknown 0 < 1.3.0 ; affected 1.3.0 < 1.3.0.130 ; affected 1.4.0 < 1.4.0.133 ; affected 1.5.0 < 1.5.0.135 ; affected 2.0.0 < 2.0.0.341
WSO2 · WSO2 Open banking KM	unknown 0 < 1.3.0 ; affected 1.3.0 < 1.3.0.113 ; affected 1.4.0 < 1.4.0.129 ; affected 1.5.0 < 1.5.0.119
WSO2 · WSO2 Open Banking IAM	affected 2.0.0 < 2.0.0.362
WSO2 · WSO2 Carbon Identity Management	affected 5.7.5 < 5.7.5.9 ; affected 5.10.86 < 5.10.86.4 ; affected 5.10.112 < 5.10.112.14 ; affected 5.11.148 < 5.11.148.13 ; affected 5.11.256 < 5.11.256.15 ; affected 5.12.153 < 5.12.153.58

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD