Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2024-7487

Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 7.0.0 to < 7.0.0.65affected

WSO2 Client Attestation Filter

Default version status: unknown

  • 7.0.26 to < 7.0.26.24affected
  • 7.0.51 to ≤ *unaffected

WSO2 WSO2 Carbon Identity Client Attestation Met Data Mgt BE

Default version status: unknown

  • 7.0.78 to < 7.0.78.44affected
  • 7.1.30 to ≤ *unaffected

References