CVE-2025-1396: identity server 5.10.0, 5.11.0, 6.0.0 (+1 more affected versions); +5 more affected products

Affected technology

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

identity server · 6.0.0
wso2

identity server · 6.1.0
wso2

identity server as key manager · 5.10.0
wso2

open banking iam · 2.0.0
wso2

WSO2 Identity Server · 5.10.0 to before 5.10.0.346, 5.11.0 to before 5.11.0.395, 6.0.0 to before 6.0.0.231, 6.1.0 to before 6.1.0.223
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.390
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.339
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 3.7/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.