# CVE-2024-12141: Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.

An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

## Remediation

- fix: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/#solution (source: CNA: WSO2)

## Affected products and versions

- WSO2 / WSO2 Identity Server: ≥ 0; < 5.10.0 (unknown, custom); 5.10.0 (affected, custom); 5.11.0 (affected, custom); 6.0.0 (affected, custom); 6.1.0 (affected, custom); 7.0.0 (affected, custom); 7.1.0 (affected, custom). Source: CNA: WSO2

## Severity and prioritization

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; source: CNA: WSO2

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-601

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/ (CNA: WSO2; vendor-advisory)

## Provenance

- CNA: WSO2: https://www.cve.org/CVERecord?id=CVE-2024-12141; retrieved 2026-11-02; source updated 2026-11-02

Revision: c1510c59b399e84e98c40e069a9342dbb67b909686b2e8fb15b15c9c7728466b

Canonical: https://y2.dev/cve/CVE-2024-12141