CVE-2025-10149: WSO2 Identity Server as Key Manager 5.10.0 to before 5.10.0.370; +4 more affected products

Affected technology

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.370
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.419
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.379, 5.11.0 to before 5.11.0.415, 6.0.0 to before 6.0.0.251, 6.1.0 to before 6.1.0.251, 7.0.0 to before 7.0.0.127, 7.1.0 to before 7.1.0.34
WSO2

WSO2 Carbon SCIM Common Component · 5.6.0 to before 5.6.0.1, 5.6.1 to before 5.6.1.2, 5.7.0 to before 5.7.0.3, 5.7.1 to before 5.7.1.1, 5.7.7 to before 5.7.7.1, 5.7.8 to before 5.7.8.1
WSO2

WSO2 Carbon SCIM 2.0 Common Component · 1.5.1 to before 1.5.1.40, 1.5.46 to before 1.5.46.47
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says this occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. Source advisory’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.