CVE-2025-0672: identity server 5.10.0, 5.11.0; +5 more affected products

Affected technology

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

identity server as key manager · 5.10.0
wso2

open banking iam · 2.0.0
wso2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.338
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.345, 5.11.0 to before 5.11.0.394
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.389
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could get past authentication checks under the conditions described by the source. Source advisory’s CVSS 3.1 assessment (base score 3.3/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 3.8/10) rates confidentiality and integrity impact as low; availability impact as none.