CVE-2025-13394: Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

DescriptionCVE.org

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

• WSO2 · WSO2 Identity Serverfrom 5.10.0 before 5.10.0.381; from 5.11.0 before 5.11.0.428; from 6.0.0 before 6.0.0.255; from 6.1.0 before 6.1.0.256; from 7.0.0 before 7.0.0.133; from 7.1.0 before 7.1.0.41 and 1 more
• WSO2 · WSO2 API Managerfrom 3.1.0 before 3.1.0.352; from 3.2.0 before 3.2.0.456; from 3.2.1 before 3.2.1.75; from 4.0.0 before 4.0.0.376; from 4.1.0 before 4.1.0.239; from 4.2.0 before 4.2.0.179 and 4 more
• WSO2 · WSO2 Open Banking IAMfrom 2.0.0 before 2.0.0.421
• WSO2 · WSO2 Open Banking AMfrom 2.0.0 before 2.0.0.401
• WSO2 · WSO2 Identity Server as Key Managerfrom 5.10.0 before 5.10.0.372
• WSO2 · WSO2 API Control Planefrom 4.5.0 before 4.5.0.39; from 4.6.0 before 4.6.0.3
• WSO2 · WSO2 Universal Gatewayfrom 4.5.0 before 4.5.0.37; from 4.6.0 before 4.6.0.3
• WSO2 · WSO2 Traffic Managerfrom 4.5.0 before 4.5.0.37; from 4.6.0 before 4.6.0.3
• WSO2 · WSO2 Enterprise Integratorfrom 6.6.0 before 6.6.0.227
• WSO2 · WSO2 Carbon Identity Entitlement UIfrom 5.17.5 before 5.17.5.331; from 5.18.187 before 5.18.187.329; from 5.23.8 before 5.23.8.210; from 5.25.92 before 5.25.92.166; from 7.0.78 before 7.0.78.157
• WSO2 · WSO2 Carbon Identity Management UI1from 5.17.5 before 5.17.5.330; from 5.17.5 before 5.17.5.331; from 5.17.118 before 5.17.118.22; from 5.18.187 before 5.18.187.328; from 5.18.187 before 5.18.187.329; from 5.18.248 before 5.18.248.31 and 10 more
• WSO2 · WSO2 Carbon Identity User Store Configuration UIfrom 5.14.127 before 5.14.127.13; from 5.17.5 before 5.17.5.330; from 5.17.5 before 5.17.5.331; from 5.17.118 before 5.17.118.22; from 5.18.187 before 5.18.187.328; from 5.18.187 before 5.18.187.329 and 11 more
• WSO2 · WSO2 Carbon Registry Profiles UIfrom 4.7.32 before 4.7.32.18; from 4.7.33 before 4.7.33.16; from 4.8.9 before 4.8.9.16; from 4.8.12 before 4.8.12.8; from 4.8.24 before 4.8.24.6; from 4.8.43 before 4.8.43.4 and 1 more
• WSO2 · WSO2 Carbon Registry Properties UIfrom 4.7.24 before 4.7.24.11; from 4.7.32 before 4.7.32.16; from 4.7.32 before 4.7.32.18; from 4.7.33 before 4.7.33.16; from 4.7.35 before 4.7.35.15; from 4.7.39 before 4.7.39.12 and 12 more
• WSO2 · WSO2 Carbon Registry Resources UIfrom 4.7.24 before 4.7.24.11; from 4.7.32 before 4.7.32.16; from 4.7.32 before 4.7.32.18; from 4.7.33 before 4.7.33.16; from 4.7.35 before 4.7.35.15; from 4.7.39 before 4.7.39.12 and 12 more
• WSO2 · WSO2 Carbon Registry Search UIfrom 4.7.24 before 4.7.24.11; from 4.7.32 before 4.7.32.16; from 4.7.32 before 4.7.32.18; from 4.7.33 before 4.7.33.16; from 4.7.35 before 4.7.35.15; from 4.7.39 before 4.7.39.12 and 6 more
• WSO2 · WSO2 Stratos User Interface For Tenant CRUD Operationsfrom 4.8.1 before 4.8.1.6; from 4.8.7 before 4.8.7.3; from 4.9.8 before 4.9.8.7; from 4.9.10 before 4.9.10.7; from 4.9.10 before 4.9.10.8; from 4.9.20 before 4.9.20.5 and 8 more
• WSO2 · WSO2 Stratos SSO Redirector UI Componentfrom 4.8.1 before 4.8.1.6
• WSO2 · WSO2 Carbon Email Verification UIfrom 4.7.19 before 4.7.19.14
• WSO2 · WSO2 Carbon Event Simulator UIfrom 2.2.11 before 2.2.11.1; from 2.2.14 before 2.2.14.11; from 2.2.14 before 2.2.14.12; from 2.2.17 before 2.2.17.5; from 2.3.1 before 2.3.1.4; from 2.3.5 before 2.3.5.6

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Cross-Site Request Forgery

Vendor

WSO2

Published

August 2026

Band

Unlikely (under 1%), August 2026

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-352cwe.mitre.org
• Vendor advisorysecurity.docs.wso2.com