CVE-2025-10149Published
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
cve-program · CVE-2025-10149
PublishedWSO2 Identity Server as Key Manager
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.370",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Open Banking IAM
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.419",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Identity Server
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.379",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.11.0",
"lessThan": "5.11.0.415",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.0.0.251",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.0.251",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.0.127",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.1.0",
"lessThan": "7.1.0.34",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon SCIM Common Component",
"packageName": "org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common",
"versions": [
{
"status": "affected",
"version": "5.6.0",
"lessThan": "5.6.0.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.6.1",
"lessThan": "5.6.1.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.7.0",
"lessThan": "5.7.0.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.7.1",
"lessThan": "5.7.1.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.7.7",
"lessThan": "5.7.7.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.7.8",
"lessThan": "5.7.8.1",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}org.wso2.carbon.identity.inbound.provisioning.scim2:org.wso2.carbon.identity.scim2.common
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon SCIM 2.0 Common Component",
"packageName": "org.wso2.carbon.identity.inbound.provisioning.scim2:org.wso2.carbon.identity.scim2.common",
"versions": [
{
"status": "affected",
"version": "1.5.1",
"lessThan": "1.5.1.40",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.5.46",
"lessThan": "1.5.46.47",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}Original source record · Cite this exact observation · Complete original publisher JSON