identity server as key manager vulnerabilities and fixes

Recent CVEs affecting identity server as key manager, with upgrade or downgrade steps. 8 tracked.

Also searched as: identityserveraskeymanager.

identity server as key manager has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-09-03. Highest priority: CVE-2025-15039 (score 51/100).

• CVE-2025-12737 HIGH 8.4 UPGRADE UPGRADE The administrative operations within the Carbon Console do not adequately validate specific user-supplied inpu
• CVE-2025-15039 CRITICAL 9.4 UPGRADE UPGRADE The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of a
• CVE-2025-13736 LOW 3.7 UPGRADE UPGRADE When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user ac
• CVE-2025-13394 MEDIUM 5.4 UPGRADE UPGRADE The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-
• CVE-2024-8995 MEDIUM 4.9 UPGRADE UPGRADE Unused authorization codes issued to deleted users are not being properly invalidated or removed from the syst
• CVE-2026-0637 MEDIUM 4.4 UPGRADE UPGRADE When an Event Publisher output adapter is configured with irrelevant properties, the affected products log the
• CVE-2024-10302 MEDIUM 4.0 DOWNGRADE DOWNGRADE The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input
• CVE-2024-6832 MEDIUM 5.9 DOWNGRADE DOWNGRADE The account locking mechanism fails to trigger when secondary user stores are inaccessible

FAQ

How do I fix identity server as key manager vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is identity server as key manager being exploited right now?

None of the tracked identity server as key manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which identity server as key manager CVE should I patch first?

CVE-2025-15039 currently ranks highest (51/100): The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of a.

RSS feed for identity server as key manager · ← Back to latest CVEs