Do Son WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.
API Manager
WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.
WSO2 patched two Critical flaws: CVE-2025-10611 (CVSS 9.8) allows unauthenticated admin bypass of System REST APIs, and CVE-2025-9804 (CVSS 9.6) allows privilege escalation via SOAP services.
A critical XXE vulnerability (CVE-2025-2905) in WSO2 API Manager allows attackers to read files and cause DoS. Patch WSO2-2016-0151 is the solution.