CVE-2024-1248: The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to proper

Routine

MEDIUM 4.8REMOTEUPGRADEUPGRADEUPGRADE

CVE-2024-1248 is a medium-severity flaw (CVSS 4.8) affecting api manager, identity server, identity server as key manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacke

Why this priority

Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	4.8 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	0.3% (top 77%)
CISA exploited list	No
Weakness	CWE-298
Published	2026-07-04
Last modified	2026-07-09

Publisher (CNA): WSO2 LLC · Vendor: wso2

Last updated 2026-07-09 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-07-04 21:17 UTCPublished CVE record published
2026-07-09 18:47 UTCUpdated Record last modified

wso2 api manager UPGRADE

Affected: >= 3.0.0 and < 3.0.0.153 · >= 3.1.0 and < 3.1.0.267 · >= 3.2.0 and < 3.2.0.351 · >= 4.0.0 and < 4.0.0.269 · >= 4.1.0 and < 4.1.0.169

Fixed in: 3.0.0.153, 3.1.0.267, 3.2.0.351, 4.0.0.269, 4.1.0.169

Safe to downgrade to: a release before 3.0.0

1. Check installed version

apt-cache policy api-manager || rpm -q api-manager || api-manager --version

2. UPGRADE to 3.0.0.153 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade api-manager

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade api-manager

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 3.0.0 (Debian / Ubuntu)

apt-cache madison api-manager sudo apt install api-manager=<VERSION_BEFORE_3.0.0> sudo apt-mark hold api-manager

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list api-manager sudo dnf downgrade api-manager-<VERSION_BEFORE_3.0.0> sudo dnf versionlock add api-manager

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

wso2 identity server UPGRADE

Affected: >= 5.8.0 and < 5.8.0.101 · >= 5.9.0 and < 5.9.0.138 · >= 5.10.0 and < 5.10.0.284 · >= 5.11.0 and < 5.11.0.321

Fixed in: 5.8.0.101, 5.9.0.138, 5.10.0.284, 5.11.0.321

Safe to downgrade to: a release before 5.8.0

1. Check installed version

apt-cache policy identity-server || rpm -q identity-server || identity-server --version

2. UPGRADE to 5.8.0.101 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade identity-server

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade identity-server

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 5.8.0 (Debian / Ubuntu)

apt-cache madison identity-server sudo apt install identity-server=<VERSION_BEFORE_5.8.0> sudo apt-mark hold identity-server

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list identity-server sudo dnf downgrade identity-server-<VERSION_BEFORE_5.8.0> sudo dnf versionlock add identity-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

wso2 identity server as key manager UPGRADE

Affected: >= 5.9.0 and < 5.9.0.148 · >= 5.10.0 and < 5.10.0.280

Fixed in: 5.9.0.148, 5.10.0.280

Safe to downgrade to: a release before 5.9.0

1. Check installed version

apt-cache policy identity-server-as-key-manager || rpm -q identity-server-as-key-manager || identity-server-as-key-manager --version

2. UPGRADE to 5.9.0.148 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade identity-server-as-key-manager

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade identity-server-as-key-manager

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 5.9.0 (Debian / Ubuntu)

apt-cache madison identity-server-as-key-manager sudo apt install identity-server-as-key-manager=<VERSION_BEFORE_5.9.0> sudo apt-mark hold identity-server-as-key-manager

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list identity-server-as-key-manager sudo dnf downgrade identity-server-as-key-manager-<VERSION_BEFORE_5.9.0> sudo dnf versionlock add identity-server-as-key-manager

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

wso2 open banking am UPGRADE

Affected: >= 2.0.0 and < 2.0.0.313

Fixed in: 2.0.0.313

Safe to downgrade to: a release before 2.0.0

1. Check installed version

apt-cache policy open-banking-am || rpm -q open-banking-am || open-banking-am --version

2. UPGRADE to 2.0.0.313 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade open-banking-am

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade open-banking-am

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)

apt-cache madison open-banking-am sudo apt install open-banking-am=<VERSION_BEFORE_2.0.0> sudo apt-mark hold open-banking-am

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list open-banking-am sudo dnf downgrade open-banking-am-<VERSION_BEFORE_2.0.0> sudo dnf versionlock add open-banking-am

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

wso2 open banking iam UPGRADE

Affected: >= 2.0.0 and < 2.0.0.333

Fixed in: 2.0.0.333

Safe to downgrade to: a release before 2.0.0

1. Check installed version

apt-cache policy open-banking-iam || rpm -q open-banking-iam || open-banking-iam --version

2. UPGRADE to 2.0.0.333 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade open-banking-iam

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade open-banking-iam

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)

apt-cache madison open-banking-iam sudo apt install open-banking-iam=<VERSION_BEFORE_2.0.0> sudo apt-mark hold open-banking-iam

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list open-banking-iam sudo dnf downgrade open-banking-iam-<VERSION_BEFORE_2.0.0> sudo dnf versionlock add open-banking-iam

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-1248?

api manager: upgrade to 3.0.0.153, 3.1.0.267, 3.2.0.351, 4.0.0.269, 4.1.0.169; identity server: upgrade to 5.8.0.101, 5.9.0.138, 5.10.0.284, 5.11.0.321; identity server as key manager: upgrade to 5.9.0.148, 5.10.0.280. Exact commands for each OS are on this page.

Is CVE-2024-1248 being exploited?

CVE-2024-1248 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-1248 affect?

CVE-2024-1248 affects api manager, identity server, identity server as key manager. Severity is medium (CVSS 4.8). The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisi

How urgent is CVE-2024-1248?

Priority 28/100. Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-2053 HIGH 8.3 UPGRADE The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently va
CVE-2025-12737 HIGH 8.4 UPGRADE UPGRADE The administrative operations within the Carbon Console do not adequately validate specific user-supplied inpu
CVE-2025-8591 MEDIUM 6.1 UPGRADE UPGRADE The software accepts user-supplied input via a URL parameter without adequate output encoding before reflectin
CVE-2025-13475 LOW 3.5 UPGRADE UPGRADE In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent
CVE-2025-15039 CRITICAL 9.4 UPGRADE UPGRADE The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of a

References

← Back to latest CVEs