Answer in brief
CVE-2025-14260 records a High severity (CVSS 8.3) vulnerability in Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources. The current sources do not mark it as known exploited. The current feed maps WSO2/SAML2 SSO Authenticator UI Bundle (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Carbon UI (generic), WSO2/WSO2 Identity Server (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WSO2/SAML2 SSO Authenticator UI Bundle (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Carbon UI (generic), WSO2/WSO2 Identity Server (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| WSO2/SAML2 SSO Authenticator UI Bundlegeneric | >=5.5.0 <5.5.0.2 || >=5.5.2 <5.5.2.5 || >=5.5.9 <5.5.9.4 || >=5.5.10 <5.5.10.1 || >=5.6.4 <5.6.4.1 || >=5.7.2 <5.7.2.1 || >=5.8.3 <5.8.3.1 || >=5.8.7 <5.8.7.2 || >=5.9.4 <5.9.4.2 | 5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2 |
| WSO2/WSO2 API Managergeneric | >=3.1.0 <3.1.0.354 || >=3.2.0 <3.2.0.458 || >=3.2.1 <3.2.1.99 || >=4.0.0 <4.0.0.379 || >=4.1.0 <4.1.0.265 || >=4.2.0 <4.2.0.205 || >=4.3.0 <4.3.0.115 || >=4.4.0 <4.4.0.79 | 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79 |
| WSO2/WSO2 Carbon UIgeneric | >=4.6.0 <4.6.0.2300 || >=4.6.1 <4.6.1.165 || >=4.6.3 <4.6.3.46 || >=4.6.4 <4.6.4.28 || >=4.7.1 <4.7.1.79 || >=4.8.1 <4.8.1.50 || >=4.9.0 <4.9.0.107 || >=4.9.26 <4.9.26.37 || >=4.9.27 <4.9.27.24 || >=4.10.9 <4.10.9.77 | 4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77 |
| WSO2/WSO2 Identity Servergeneric | >=5.10.0 <5.10.0.383 || >=5.11.0 <5.11.0.430 || >=6.0.0 <6.0.0.256 || >=6.1.0 <6.1.0.257 || >=7.0.0 <7.0.0.134 | 5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134 |
| WSO2/WSO2 Identity Server as Key Managergeneric | >=5.10.0 <5.10.0.374 | 5.10.0.374 |
| WSO2/WSO2 Open Banking AMgeneric | >=2.0.0 <2.0.0.403 | 2.0.0.403 |
| WSO2/WSO2 Open Banking IAMgeneric | >=2.0.0 <2.0.0.423 | 2.0.0.423 |
Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
Quoted source text, attributed separately from HOL analysis.