WSO2 JWT Grant Type for OAuth2 Identity Provider Validation state issue

Summaryinfo

A vulnerability has been found in WSO2 Universal Gateway, Traffic Manager, API Manager, API Control Plane, Identity Server, Open Banking AM, Open Banking IAM, Identity Server as Key Manager, Carbon OAuth and JWT Grant Type for OAuth2 and classified as critical. This issue affects some unknown processing of the component Identity Provider Validation. The manipulation leads to state issue. This vulnerability is documented as CVE-2025-1397. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in WSO2 Universal Gateway, Traffic Manager, API Manager, API Control Plane, Identity Server, Open Banking AM, Open Banking IAM, Identity Server as Key Manager, Carbon OAuth and JWT Grant Type for OAuth2. It has been rated as critical. This issue affects an unknown part of the component Identity Provider Validation. The manipulation with an unknown input leads to a state issue vulnerability. Using CWE to declare the problem leads to CWE-371. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.

The advisory is shared at security.docs.wso2.com. The identification of this vulnerability is CVE-2025-1397 since 02/17/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/03/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Control Plane
• API Manager
• Carbon OAuth
• Identity Server
• Identity Server as Key Manager
• JWT Grant Type for OAuth2
• Open Banking AM
• Open Banking IAM
• Traffic Manager
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion