CVE-2025-13394 PUBLISHED

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Assigner: WSO2
Reserved: 19.11.2025 Published: 06.08.2026 Updated: 06.08.2026

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.

An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Product Status

Vendor WSO2
Product WSO2 Identity Server
Versions Default: unaffected
  • unknown from 0 to 5.10.0 (excl.)
  • affected from 5.10.0 to 5.10.0.381 (excl.)
  • affected from 5.11.0 to 5.11.0.428 (excl.)
  • affected from 6.0.0 to 6.0.0.255 (excl.)
  • affected from 6.1.0 to 6.1.0.256 (excl.)
  • affected from 7.0.0 to 7.0.0.133 (excl.)
  • affected from 7.1.0 to 7.1.0.41 (excl.)
  • affected from 7.2.0 to 7.2.0.3 (excl.)
Vendor WSO2
Product WSO2 API Manager
Versions Default: unaffected
  • unknown from 0 to 3.1.0 (excl.)
  • affected from 3.1.0 to 3.1.0.352 (excl.)
  • affected from 3.2.0 to 3.2.0.456 (excl.)
  • affected from 3.2.1 to 3.2.1.75 (excl.)
  • affected from 4.0.0 to 4.0.0.376 (excl.)
  • affected from 4.1.0 to 4.1.0.239 (excl.)
  • affected from 4.2.0 to 4.2.0.179 (excl.)
  • affected from 4.3.0 to 4.3.0.91 (excl.)
  • affected from 4.4.0 to 4.4.0.55 (excl.)
  • affected from 4.5.0 to 4.5.0.38 (excl.)
  • affected from 4.6.0 to 4.6.0.3 (excl.)
Vendor WSO2
Product WSO2 Open Banking IAM
Versions Default: unaffected
  • unknown from 0 to 2.0.0 (excl.)
  • affected from 2.0.0 to 2.0.0.421 (excl.)
Vendor WSO2
Product WSO2 Open Banking AM
Versions Default: unaffected
  • unknown from 0 to 2.0.0 (excl.)
  • affected from 2.0.0 to 2.0.0.401 (excl.)
Vendor WSO2
Product WSO2 Identity Server as Key Manager
Versions Default: unaffected
  • unknown from 0 to 5.10.0 (excl.)
  • affected from 5.10.0 to 5.10.0.372 (excl.)
Vendor WSO2
Product WSO2 API Control Plane
Versions Default: unaffected
  • unknown from 0 to 4.5.0 (excl.)
  • affected from 4.5.0 to 4.5.0.39 (excl.)
  • affected from 4.6.0 to 4.6.0.3 (excl.)
Vendor WSO2
Product WSO2 Universal Gateway
Versions Default: unaffected
  • unknown from 0 to 4.5.0 (excl.)
  • affected from 4.5.0 to 4.5.0.37 (excl.)
  • affected from 4.6.0 to 4.6.0.3 (excl.)
Vendor WSO2
Product WSO2 Traffic Manager
Versions Default: unaffected
  • unknown from 0 to 4.5.0 (excl.)
  • affected from 4.5.0 to 4.5.0.37 (excl.)
  • affected from 4.6.0 to 4.6.0.3 (excl.)
Vendor WSO2
Product WSO2 Enterprise Integrator
Versions Default: unaffected
  • unknown from 0 to 6.6.0 (excl.)
  • affected from 6.6.0 to 6.6.0.227 (excl.)
Vendor WSO2
Product WSO2 Carbon Identity Entitlement UI
Versions Default: unknown
  • affected from 5.17.5 to 5.17.5.331 (excl.)
  • affected from 5.18.187 to 5.18.187.329 (excl.)
  • affected from 5.23.8 to 5.23.8.210 (excl.)
  • affected from 5.25.92 to 5.25.92.166 (excl.)
  • affected from 7.0.78 to 7.0.78.157 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Identity Management UI1
Versions Default: unknown
  • affected from 5.17.5 to 5.17.5.330 (excl.)
  • affected from 5.17.5 to 5.17.5.331 (excl.)
  • affected from 5.17.118 to 5.17.118.22 (excl.)
  • affected from 5.18.187 to 5.18.187.328 (excl.)
  • affected from 5.18.187 to 5.18.187.329 (excl.)
  • affected from 5.18.248 to 5.18.248.31 (excl.)
  • affected from 5.23.8 to 5.23.8.210 (excl.)
  • affected from 5.24.8 to 5.24.8.26 (excl.)
  • affected from 5.25.92 to 5.25.92.166 (excl.)
  • affected from 5.25.705 to 5.25.705.21 (excl.)
  • affected from 5.25.713 to 5.25.713.10 (excl.)
  • affected from 5.25.724 to 5.25.724.5 (excl.)
  • affected from 5.25.736 to 5.25.736.1 (excl.)
  • affected from 7.0.78 to 7.0.78.157 (excl.)
  • affected from 7.8.23 to 7.8.23.67 (excl.)
  • affected from 7.8.586 to 7.8.586.7 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Identity User Store Configuration UI
Versions Default: unknown
  • affected from 5.14.127 to 5.14.127.13 (excl.)
  • affected from 5.17.5 to 5.17.5.330 (excl.)
  • affected from 5.17.5 to 5.17.5.331 (excl.)
  • affected from 5.17.118 to 5.17.118.22 (excl.)
  • affected from 5.18.187 to 5.18.187.328 (excl.)
  • affected from 5.18.187 to 5.18.187.329 (excl.)
  • affected from 5.18.248 to 5.18.248.31 (excl.)
  • affected from 5.23.8 to 5.23.8.210 (excl.)
  • affected from 5.24.8 to 5.24.8.26 (excl.)
  • affected from 5.25.92 to 5.25.92.166 (excl.)
  • affected from 5.25.705 to 5.25.705.21 (excl.)
  • affected from 5.25.713 to 5.25.713.10 (excl.)
  • affected from 5.25.724 to 5.25.724.5 (excl.)
  • affected from 5.25.736 to 5.25.736.1 (excl.)
  • affected from 7.0.78 to 7.0.78.157 (excl.)
  • affected from 7.8.23 to 7.8.23.67 (excl.)
  • affected from 7.8.586 to 7.8.586.7 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Profiles UI
Versions Default: unknown
  • affected from 4.7.32 to 4.7.32.18 (excl.)
  • affected from 4.7.33 to 4.7.33.16 (excl.)
  • affected from 4.8.9 to 4.8.9.16 (excl.)
  • affected from 4.8.12 to 4.8.12.8 (excl.)
  • affected from 4.8.24 to 4.8.24.6 (excl.)
  • affected from 4.8.43 to 4.8.43.4 (excl.)
  • affected from 4.8.50 to 4.8.50.3 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Properties UI
Versions Default: unknown
  • affected from 4.7.24 to 4.7.24.11 (excl.)
  • affected from 4.7.32 to 4.7.32.16 (excl.)
  • affected from 4.7.32 to 4.7.32.18 (excl.)
  • affected from 4.7.33 to 4.7.33.16 (excl.)
  • affected from 4.7.35 to 4.7.35.15 (excl.)
  • affected from 4.7.39 to 4.7.39.12 (excl.)
  • affected from 4.7.51 to 4.7.51.8 (excl.)
  • affected from 4.8.3 to 4.8.3.10 (excl.)
  • affected from 4.8.9 to 4.8.9.16 (excl.)
  • affected from 4.8.12 to 4.8.12.8 (excl.)
  • affected from 4.8.13 to 4.8.13.9 (excl.)
  • affected from 4.8.24 to 4.8.24.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.36 to 4.8.36.2 (excl.)
  • affected from 4.8.43 to 4.8.43.2 (excl.)
  • affected from 4.8.43 to 4.8.43.4 (excl.)
  • affected from 4.8.50 to 4.8.50.1 (excl.)
  • affected from 4.8.50 to 4.8.50.3 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Resources UI
Versions Default: unknown
  • affected from 4.7.24 to 4.7.24.11 (excl.)
  • affected from 4.7.32 to 4.7.32.16 (excl.)
  • affected from 4.7.32 to 4.7.32.18 (excl.)
  • affected from 4.7.33 to 4.7.33.16 (excl.)
  • affected from 4.7.35 to 4.7.35.15 (excl.)
  • affected from 4.7.39 to 4.7.39.12 (excl.)
  • affected from 4.7.51 to 4.7.51.8 (excl.)
  • affected from 4.8.3 to 4.8.3.10 (excl.)
  • affected from 4.8.9 to 4.8.9.16 (excl.)
  • affected from 4.8.12 to 4.8.12.8 (excl.)
  • affected from 4.8.13 to 4.8.13.9 (excl.)
  • affected from 4.8.24 to 4.8.24.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.36 to 4.8.36.2 (excl.)
  • affected from 4.8.43 to 4.8.43.2 (excl.)
  • affected from 4.8.43 to 4.8.43.4 (excl.)
  • affected from 4.8.50 to 4.8.50.1 (excl.)
  • affected from 4.8.50 to 4.8.50.3 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Search UI
Versions Default: unknown
  • affected from 4.7.24 to 4.7.24.11 (excl.)
  • affected from 4.7.32 to 4.7.32.16 (excl.)
  • affected from 4.7.32 to 4.7.32.18 (excl.)
  • affected from 4.7.33 to 4.7.33.16 (excl.)
  • affected from 4.7.35 to 4.7.35.15 (excl.)
  • affected from 4.7.39 to 4.7.39.12 (excl.)
  • affected from 4.7.51 to 4.7.51.8 (excl.)
  • affected from 4.8.3 to 4.8.3.10 (excl.)
  • affected from 4.8.9 to 4.8.9.16 (excl.)
  • affected from 4.8.12 to 4.8.12.8 (excl.)
  • affected from 4.8.13 to 4.8.13.9 (excl.)
  • affected from 4.8.24 to 4.8.24.6 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Stratos User Interface For Tenant CRUD Operations
Versions Default: unknown
  • affected from 4.8.1 to 4.8.1.6 (excl.)
  • affected from 4.8.7 to 4.8.7.3 (excl.)
  • affected from 4.9.8 to 4.9.8.7 (excl.)
  • affected from 4.9.10 to 4.9.10.7 (excl.)
  • affected from 4.9.10 to 4.9.10.8 (excl.)
  • affected from 4.9.20 to 4.9.20.5 (excl.)
  • affected from 4.9.27 to 4.9.27.1 (excl.)
  • affected from 4.9.31 to 4.9.31.1 (excl.)
  • affected from 4.9.34 to 4.9.34.1 (excl.)
  • affected from 4.9.42 to 4.9.42.1 (excl.)
  • affected from 4.11.0 to 4.11.0.7 (excl.)
  • affected from 4.11.19 to 4.11.19.4 (excl.)
  • affected from 4.11.34 to 4.11.34.3 (excl.)
  • affected from 4.11.45 to 4.11.45.1 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Stratos SSO Redirector UI Component
Versions Default: unknown
  • affected from 4.8.1 to 4.8.1.6 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Email Verification UI
Versions Default: unknown
  • affected from 4.7.19 to 4.7.19.14 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Event Simulator UI
Versions Default: unknown
  • affected from 2.2.11 to 2.2.11.1 (excl.)
  • affected from 2.2.14 to 2.2.14.11 (excl.)
  • affected from 2.2.14 to 2.2.14.12 (excl.)
  • affected from 2.2.17 to 2.2.17.5 (excl.)
  • affected from 2.3.1 to 2.3.1.4 (excl.)
  • affected from 2.3.5 to 2.3.5.6 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Execution Manager UI
Versions Default: unknown
  • affected from 5.2.24 to 5.2.24.10 (excl.)
  • affected from 5.2.26 to 5.2.26.22 (excl.)
  • affected from 5.2.34 to 5.2.34.12 (excl.)
  • affected from 5.2.41 to 5.2.41.7 (excl.)
  • affected from 5.2.57 to 5.2.57.10 (excl.)
  • affected from 5.3.5 to 5.3.5.9 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Governance Custom Lifecycle Checklist UI
Versions Default: unknown
  • affected from 4.8.14 to 4.8.14.4 (excl.)
  • affected from 4.8.19 to 4.8.19.8 (excl.)
  • affected from 4.8.21 to 4.8.21.10 (excl.)
  • affected from 4.8.28 to 4.8.28.4 (excl.)
  • affected from 4.8.30 to 4.8.30.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Governance Generic Artifact User Interface
Versions Default: unknown
  • affected from 4.8.14 to 4.8.14.4 (excl.)
  • affected from 4.8.19 to 4.8.19.8 (excl.)
  • affected from 4.8.21 to 4.8.21.10 (excl.)
  • affected from 4.8.28 to 4.8.28.4 (excl.)
  • affected from 4.8.30 to 4.8.30.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.33 to 4.8.33.4 (excl.)
  • affected from 4.8.34 to 4.8.34.5 (excl.)
  • affected from 4.8.37 to 4.8.37.4 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Governance Life Cycles User Interface
Versions Default: unknown
  • affected from 4.8.14 to 4.8.14.4 (excl.)
  • affected from 4.8.19 to 4.8.19.8 (excl.)
  • affected from 4.8.21 to 4.8.21.10 (excl.)
  • affected from 4.8.28 to 4.8.28.4 (excl.)
  • affected from 4.8.30 to 4.8.30.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Governance WSDL Tool UI
Versions Default: unknown
  • affected from 4.8.14 to 4.8.14.4 (excl.)
  • affected from 4.8.19 to 4.8.19.8 (excl.)
  • affected from 4.8.21 to 4.8.21.10 (excl.)
  • affected from 4.8.28 to 4.8.28.4 (excl.)
  • affected from 4.8.30 to 4.8.30.6 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.33 to 4.8.33.4 (excl.)
  • affected from 4.8.34 to 4.8.34.5 (excl.)
  • affected from 4.8.37 to 4.8.37.4 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon New Data Sources UI
Versions Default: unknown
  • affected from 4.7.19 to 4.7.19.13 (excl.)
  • affected from 4.7.24 to 4.7.24.5 (excl.)
  • affected from 4.7.32 to 4.7.32.10 (excl.)
  • affected from 4.7.35 to 4.7.35.13 (excl.)
  • affected from 4.7.49 to 4.7.49.7 (excl.)
  • affected from 4.7.52 to 4.7.52.5 (excl.)
  • affected from 4.9.2 to 4.9.2.8 (excl.)
  • affected from 4.9.11 to 4.9.11.2 (excl.)
  • affected from 4.9.18 to 4.9.18.1 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Info UI2
Versions Default: unknown
  • affected from 4.7.32 to 4.7.32.16 (excl.)
  • affected from 4.7.35 to 4.7.35.15 (excl.)
  • affected from 4.7.39 to 4.7.39.12 (excl.)
  • affected from 4.7.51 to 4.7.51.8 (excl.)
  • affected from 4.8.3 to 4.8.3.10 (excl.)
  • affected from 4.8.13 to 4.8.13.9 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.36 to 4.8.36.2 (excl.)
  • affected from 4.8.43 to 4.8.43.2 (excl.)
  • affected from 4.8.50 to 4.8.50.1 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Relations UI
Versions Default: unknown
  • affected from 4.7.24 to 4.7.24.11 (excl.)
  • affected from 4.7.32 to 4.7.32.16 (excl.)
  • affected from 4.7.35 to 4.7.35.15 (excl.)
  • affected from 4.7.39 to 4.7.39.12 (excl.)
  • affected from 4.7.51 to 4.7.51.8 (excl.)
  • affected from 4.8.3 to 4.8.3.10 (excl.)
  • affected from 4.8.13 to 4.8.13.9 (excl.)
  • affected from 4.8.32 to 4.8.32.4 (excl.)
  • affected from 4.8.36 to 4.8.36.2 (excl.)
  • affected from 4.8.43 to 4.8.43.2 (excl.)
  • affected from 4.8.50 to 4.8.50.1 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Registry Indexing
Versions Default: unknown
  • affected from 4.7 to 4.7.24 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Security UI
Versions Default: unknown
  • affected from 5.14 to 5.14.127 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Component Andes Event UI
Versions Default: unknown
  • affected from 3.3.12 to 3.3.12.3 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Component Andes UI1
Versions Default: unknown
  • affected from 3.3.12 to 3.3.12.3 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon HL7 Business Messaging Store UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Endpoint Editor UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Publish Event Mediator Configuration UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Eventing UI
Versions Default: unknown
  • affected from 4.7.19 to 4.7.19.13 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon HumanTask UI
Versions Default: unknown
  • affected from 4.5.27 to 4.5.27.10 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Logging UI
Versions Default: unknown
  • affected from 4.7.19 to 4.7.19.13 (excl.)
  • affected from 4.7.24 to 4.7.24.5 (excl.)
  • affected from 4.7.32 to 4.7.32.10 (excl.)
  • affected from 4.7.52 to 4.7.52.5 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Template Editor UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Command Mediator UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Rule Mediator UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Throttle Mediator UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Tasks Core
Versions Default: unknown
  • affected from 4.7.19 to 4.7.19.13 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Rest API Admin UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Sequence Editor UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Task UI
Versions Default: unknown
  • affected from 4.7.30 to 4.7.30.53 (excl.)
  • unaffected from x to * (incl.)
Vendor WSO2
Product WSO2 Carbon Governance
Versions Default: unknown
  • affected from 4.8.37 to 4.8.37.4 (excl.)
  • unaffected from x to * (incl.)

Solutions

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution

References

Problem Types

  • CWE-352: Cross-Site Request Forgery (CSRF) CWE

Impacts

  • CAPEC-234 CAPEC-234: Cross-Site Request Forgery