CVE-2024-12141— Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

Quick assessment

Affected

WSO2 WSO2 Identity Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该产品未能充分验证回调 URL，导致在通过弱正则表达式处理或完全省略验证时，攻击者可注入恶意载荷对其进行篡改。攻击者可构造看似合法的链接，将用户重定向至其控制的页面。此类重定向可被用于实施网络钓鱼攻击，窃取敏感用户信息，进而可能导致未经授权的访问或数据泄露。

CVSS 4.3 · Medium Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

Source: CVE Program / CVE List V5

Vulnerability Description

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

指向未可信站点的URL重定向(开放重定向)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WSO2	WSO2 Identity Server	5.10.0	-

II. Public POCs for CVE-2024-12141

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-12141

请登录查看更多情报信息。

Other References for CVE-2024-12141 (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/ vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2024-12141

Same Patch Batch · WSO2 · 2026-11-02 · 10 CVEs total

CVE-2025-11969	9.4 CRITICAL	Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized A
CVE-2026-2613	8.7 HIGH	SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inf
CVE-2025-13647	5.8 MEDIUM	Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-2372	5.4 MEDIUM	Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Atta
CVE-2024-9517	4.9 MEDIUM	Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorize
CVE-2024-5617	4.8 MEDIUM	Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute
CVE-2025-12544	4.8 MEDIUM	Stored Cross-Site Scripting in Multiple WSO2 Products
CVE-2024-7075	4.6 MEDIUM	Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple
CVE-2026-18800	4.4 MEDIUM	Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrie

IV. Related Vulnerabilities

Same product: WSO2 Identity Server

Same vendor: WSO2

Same weakness: CWE-601