{"affected":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","source":"CNA: WSO2","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"status":"affected","version":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.11.0","versionType":"custom"},{"status":"affected","version":"6.0.0","versionType":"custom"},{"status":"affected","version":"6.1.0","versionType":"custom"},{"status":"affected","version":"7.0.0","versionType":"custom"},{"status":"affected","version":"7.1.0","versionType":"custom"}]}],"cveId":"CVE-2024-12141","cwes":["CWE-601"],"description":"The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: WSO2","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793622295834,"publishedAt":1793622295834,"references":[{"source":"CNA: WSO2","tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/"}],"remediation":[{"kind":"fix","source":"CNA: WSO2","text":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/#solution"}],"revision":"c1510c59b399e84e98c40e069a9342dbb67b909686b2e8fb15b15c9c7728466b","sources":[{"modifiedAt":1793622295834,"name":"CNA: WSO2","retrievedAt":1793624899639,"url":"https://www.cve.org/CVERecord?id=CVE-2024-12141"}],"ssvc":null,"status":"published","title":"Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks","updatedAt":1793624899639}