[ CVE-2025-13647 · Published 2 Nov 2026 ]

Vulnerability in WSO2 Identity Server

CVSS 5.8 EPSS <1%No fix listed yet

[ Description ]Official description

The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2…

[ Facts ]Key facts

CVE: CVE-2025-13647
EUVD: EUVD-2025-211234
Published: 2 Nov 2026, 10:17 UTC
Updated: 4 Nov 2026, 20:10 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Scored by ed10eef1-636d-4fbe-9993-6890dfa878f8
EPSS: 0.18% chance of exploitation in 30 days · higher than 8% of CVEs
CISA SSVC: Exploitation: none · Automatable: yes · Impact: partial
Weakness: CWE-200

[ Affected ]Affected products

WSO2 WSO2 Identity Server5.10.0 – < 5.10.0.381, 5.11.0 – < 5.11.0.428, 6.0.0 – < 6.0.0.255, 6.1.0 – < 6.1.0.255, 7.0.0 – < 7.0.0.133, 7.1.0 – < 7.1.0.41
WSO2 WSO2 Open Banking IAM2.0.0 – < 2.0.0.421
WSO2 WSO2 Identity Server as Key Manager5.10.0 – < 5.10.0.372
WSO2 WSO2 Identity Server Keystore Rest API Commons1.0.82 – < 1.0.82.25, 1.0.190 – < 1.0.190.17, 1.2.3 – < 1.2.3.6, 1.2.23 – < 1.2.23.10, 1.2.176 – < 1.2.176.18, 1.3.83 – < 1.3.83.10
WSO2 WSO2 Identity Server Keystore Rest API V11.0.82 – < 1.0.82.25, 1.0.190 – < 1.0.190.17, 1.2.3 – < 1.2.3.6, 1.2.23 – < 1.2.23.10, 1.2.176 – < 1.2.176.18, 1.3.83 – < 1.3.83.10