CVE-2026-6647

The XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause denial of service, conduct SSRF attacks, or have unspecified other impacts via a crafted XACML request.

CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 that allows remote attackers to hijack the authentication of privileged users for requests processing XACML requests.

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist, allowing attackers to differentiate between valid and invalid usernames. This difference can be leveraged to enumerate existing user accounts.

WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in MFA. Unused OTPs remain valid indefinitely, allowing attackers to conduct brute force attacks by repeatedly guessing the code. A successful attack can lead to MFA bypass and unauthorized account takeover.

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation can result in unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and denial-of-service.

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage.

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their ability to act as the legitimate user. An attacker who gains access to an impersonated user's access token can exploit this weakness to renew their authorization, resulting in continued ability to perform actions on behalf of the actual user, compromising log integrity and traceability.

Unused authorization codes issued to deleted users are not properly invalidated or removed, allowing potential reuse. An attacker with the code and client credentials can obtain access tokens on behalf of deleted users, leading to unauthorized access.

The account locking mechanism fails when secondary user stores are inaccessible, allowing repeated authentication attempts without lockout. This leaves users in accessible stores vulnerable to brute force attacks.