Research · Aug 6, 2026
Critical Path Traversal Vulnerability Discovered in WSO2 Products
A severe path traversal vulnerability has been identified in multiple WSO2 products, allowing attackers to exploit JWT authentication mechanisms and gain unauthorized access.
What changed
A newly discovered path traversal vulnerability in WSO2 products has raised significant concerns. This flaw allows attackers to exploit the JWT authentication mechanism by using tokens signed with unsupported algorithms, leading to unauthorized access and potential account takeovers.
The severity of this vulnerability is underscored by a CVSS score of 9.8, indicating a critical risk level, particularly in single-tenant deployments.
Who is affected
Various WSO2 products are impacted by this vulnerability, which poses a significant risk to organizations utilizing these solutions for their operations.
The following groups and products are notably affected:
- WSO2 Identity Server
- WSO2 API Manager
- WSO2 Enterprise Integrator
- Organizations relying on WSO2 for identity and access management solutions
What to do
Organizations using affected WSO2 products should take immediate action to mitigate the risks associated with this vulnerability. It is crucial to review and update configurations to ensure that only supported algorithms are utilized.
Regular security audits and monitoring for unusual access patterns can also help in identifying potential exploitation of this vulnerability.
- Review JWT configurations to restrict algorithm usage.
- Implement additional monitoring for unauthorized access attempts.
- Stay informed about patches and updates from WSO2.