# CVE-2024-2372: Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.

By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.

## Remediation

- fix: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution (source: CNA: WSO2)

## Affected products and versions

- WSO2 / WSO2 Open Banking AM: ≥ 0; < 2.0.0 (unknown, custom); ≥ 2.0.0; < 2.0.0.383 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 API Manager: ≥ 0; < 3.0.0 (unknown, custom); ≥ 3.0.0; < 3.0.0.160 (affected, custom); ≥ 3.1.0; < 3.1.0.335 (affected, custom); ≥ 3.2.0; < 3.2.0.432 (affected, custom); ≥ 3.2.1; < 3.2.1.51 (affected, custom); ≥ 4.0.0; < 4.0.0.310 (affected, custom); ≥ 4.1.0; < 4.1.0.208 (affected, custom); ≥ 4.2.0; < 4.2.0.146 (affected, custom); ≥ 4.3.0; < 4.3.0.59 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Identity Server as Key Manager: ≥ 0; < 5.9.0 (unknown, custom); ≥ 5.9.0; < 5.9.0.163 (affected, custom); ≥ 5.10.0; < 5.10.0.355 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Open Banking IAM: ≥ 0; < 2.0.0 (unknown, custom); ≥ 2.0.0; < 2.0.0.404 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Enterprise Integrator: ≥ 0; < 6.6.0 (unknown, custom); ≥ 6.6.0; < 6.6.0.212 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Identity Server: ≥ 0; < 5.9.0 (unknown, custom); ≥ 5.9.0; < 5.9.0.154 (affected, custom); ≥ 5.10.0; < 5.10.0.291 (affected, custom); ≥ 5.11.0; < 5.11.0.371 (affected, custom); ≥ 6.0.0; < 6.0.0.178 (affected, custom); ≥ 6.1.0; < 6.1.0.134 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Carbon Registry Kernel (org.wso2.carbon:org.wso2.carbon.registry.core): ≥ 4.5.1; < 4.5.1.36 (affected, custom); ≥ 4.5.3; < 4.5.3.36 (affected, custom); ≥ 4.6.0; < 4.6.0.139 (affected, custom); ≥ 4.6.0; < 4.6.0.1544 (affected, custom); ≥ 4.6.1; < 4.6.1.105 (affected, custom); ≥ 4.6.2; < 4.6.2.321 (affected, custom); ≥ 4.6.3; < 4.6.3.28 (affected, custom); ≥ 4.6.4; < 4.6.4.11 (affected, custom); ≥ 4.7.1; < 4.7.1.47 (affected, custom); ≥ 4.8.1; < 4.8.1.27 (affected, custom); ≥ 4.8.1; < 4.8.1.31 (affected, custom); ≥ 4.9.0; < 4.9.0.46 (affected, custom); ≥ 4.9.26; < 4.9.26.18 (affected, custom). Source: CNA: WSO2

## Severity and prioritization

- CVSS 3.1: 5.4 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; source: CNA: WSO2

- CVSS 3.1: 5.4 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; source: NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-601

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/ (CNA: WSO2; vendor-advisory)

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/ (ed10eef1-636d-4fbe-9993-6890dfa878f8)

## Provenance

- CNA: WSO2: https://www.cve.org/CVERecord?id=CVE-2024-2372; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-2372; retrieved 2026-11-02; source updated 2026-11-02

Revision: 556f72e848b32ac183b4c3e6e5fc83802c5f096aafd56c7797bd2173cbe58f4c

Canonical: https://y2.dev/cve/CVE-2024-2372