PatchTheCVEidentity server vulnerabilities and fixes
Recent CVEs affecting identity server, with upgrade or downgrade steps. 13 tracked.
Also searched as: identityserver.
identity server has 13 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-09-03. Highest priority: CVE-2025-15039 (score 51/100).
- CVE-2025-12737 HIGH 8.4 UPGRADE UPGRADE The administrative operations within the Carbon Console do not adequately validate specific user-supplied inpu
- CVE-2025-14779 LOW 3.8 UPGRADE The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type
- CVE-2025-15039 CRITICAL 9.4 UPGRADE UPGRADE The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of a
- CVE-2025-13736 LOW 3.7 UPGRADE UPGRADE When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user ac
- CVE-2025-13909 MEDIUM 4.3 UPGRADE The system accepts authentication requests without sufficient validation to enforce tenant isolation when usin
- CVE-2025-11850 MEDIUM 4.3 UPGRADE When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a se
- CVE-2025-13394 MEDIUM 5.4 UPGRADE UPGRADE The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-
- CVE-2025-12627 LOW 2.4 UPGRADE The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with im
- CVE-2026-2445 MEDIUM 6.1 UPGRADE UPGRADE The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitizatio
- CVE-2024-8995 MEDIUM 4.9 UPGRADE UPGRADE Unused authorization codes issued to deleted users are not being properly invalidated or removed from the syst
- CVE-2026-0637 MEDIUM 4.4 UPGRADE UPGRADE When an Event Publisher output adapter is configured with irrelevant properties, the affected products log the
- CVE-2024-10302 MEDIUM 4.0 DOWNGRADE DOWNGRADE The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input
- CVE-2024-6832 MEDIUM 5.9 DOWNGRADE DOWNGRADE The account locking mechanism fails to trigger when secondary user stores are inaccessible
FAQ
How do I fix identity server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is identity server being exploited right now?
None of the tracked identity server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which identity server CVE should I patch first?
CVE-2025-15039 currently ranks highest (51/100): The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of a.