CVE-2025-0663: identity server 5.10.0, 5.11.0, 6.0.0 (+2 more affected versions); +5 more affected products

Affected technology

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

identity server · 6.0.0
wso2

identity server · 6.1.0
wso2

identity server · 7.0.0
wso2

identity server as key manager · 5.10.0
wso2

open banking iam · 2.0.0
wso2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.387
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.336
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.343, 5.11.0 to before 5.11.0.392, 6.0.0 to before 6.0.0.228, 6.1.0 to before 6.1.0.220, 7.0.0 to before 7.0.0.88
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Adjacent network · High privileges required · No user interaction required

What an attacker can do

An attacker may gain unauthorized access and potentially take over accounts in other tenants. Source advisory’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality, integrity and availability impact as high.