CVE-2024-4989

MediumCVSS 5.4

Published: 21/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages, which can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks.

Risk Assessment

Users may be redirected to malicious sites, potentially leading to phishing and leakage of sensitive information.

Recommendation

Update WSO2 API Manager to a version containing the fix or implement validation of the callback URL parameter.

Other vulnerabilities in WSO2 API Manager

CVE-2025-9152Critical
WSO2 API Manager has an improper privilege management vulnerability due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this to generate access tokens with elevated privileges, potentially leading to administrative access.

Original NVD description (English source)

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS