Answer in brief
CVE-2026-0637 records a Medium severity (CVSS 5.4) vulnerability in Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery. The current sources do not mark it as known exploited. The current feed maps WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 API Manager (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 API Manager (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| WSO2/WSO2 API Control Planegeneric | >=4.5.0 <4.5.0.50 || >=4.6.0 <4.6.0.14 | 4.5.0.50, 4.6.0.14 |
| WSO2/WSO2 API Control Planegeneric | >=4.5.0 <4.5.0.45 || >=4.6.0 <4.6.0.13 | 4.5.0.45, 4.6.0.13 |
| WSO2/WSO2 API Managergeneric | >=3.1.0 <3.1.0.357 || >=3.2.0 <3.2.0.465 || >=3.2.1 <3.2.1.84 || >=4.1.0 <4.1.0.249 || >=4.2.0 <4.2.0.189 || >=4.3.0 <4.3.0.100 || >=4.4.0 <4.4.0.64 || >=4.5.0 <4.5.0.49 || >=4.6.0 <4.6.0.13 | 3.1.0.357, 3.2.0.465, 3.2.1.84, 4.1.0.249, 4.2.0.189, 4.3.0.100, 4.4.0.64, 4.5.0.49, 4.6.0.13 |
| WSO2/WSO2 API Managergeneric | >=3.2.0 <3.2.0.464 || >=3.2.1 <3.2.1.83 || >=4.1.0 <4.1.0.249 || >=4.2.0 <4.2.0.189 || >=4.3.0 <4.3.0.99 || >=4.4.0 <4.4.0.63 || >=4.5.0 <4.5.0.44 || >=4.6.0 <4.6.0.12 | 3.2.0.464, 3.2.1.83, 4.1.0.249, 4.2.0.189, 4.3.0.99, 4.4.0.63, 4.5.0.44, 4.6.0.12 |
| WSO2/WSO2 Carbon Event Publisher Coregeneric | >=5.2.24 <5.2.24.11 || >=5.2.26 <5.2.26.24 || >=5.2.27 <5.2.27.7 || >=5.2.41 <5.2.41.8 || >=5.2.45 <5.2.45.2 || >=5.2.50 <5.2.50.3 || >=5.2.57 <5.2.57.12 || >=5.2.58 <5.2.58.3 || >=5.2.61 <5.2.61.4 || >=5.2.64 <5.2.64.1 || >=5.3.5 <5.3.5.10 || >=5.3.11 <5.3.11.7 || >=5.3.15 <5.3.15.6 || >=5.3.20 <5.3.20.3 || >=5.3.27 <5.3.27.1 | 5.2.24.11, 5.2.26.24, 5.2.27.7, 5.2.41.8, 5.2.45.2, 5.2.50.3, 5.2.57.12, 5.2.58.3, 5.2.61.4, 5.2.64.1, 5.3.5.10, 5.3.11.7, 5.3.15.6, 5.3.20.3, 5.3.27.1 |
| WSO2/WSO2 Identity Servergeneric | >=5.10.0 <5.10.0.386 || >=5.11.0 <5.11.0.433 || >=6.0.0 <6.0.0.260 || >=6.1.0 <6.1.0.261 || >=7.0.0 <7.0.0.139 || >=7.1.0 <7.1.0.47 || >=7.2.0 <7.2.0.8 | 5.10.0.386, 5.11.0.433, 6.0.0.260, 6.1.0.261, 7.0.0.139, 7.1.0.47, 7.2.0.8 |
| WSO2/WSO2 Identity Server as Key Managergeneric | >=5.10.0 <5.10.0.377 | 5.10.0.377 |
| WSO2/WSO2 Open Banking AMgeneric | >=2.0.0 <2.0.0.406 | 2.0.0.406 |
| WSO2/WSO2 Open Banking IAMgeneric | >=2.0.0 <2.0.0.426 | 2.0.0.426 |
| WSO2/WSO2 Traffic Managergeneric | >=4.5.0 <4.5.0.48 || >=4.6.0 <4.6.0.13 | 4.5.0.48, 4.6.0.13 |
| WSO2/WSO2 Universal Gatewaygeneric | >=4.5.0 <4.5.0.49 || >=4.6.0 <4.6.0.13 | 4.5.0.49, 4.6.0.13 |
Published upstream
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 6, 2026
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs. An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
Quoted source text, attributed separately from HOL analysis.