CVE-2025-5605
moderate-risk
Published 2025-10-24
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
Do I need to act?
~
3.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10
Medium
ADJACENT_NETWORK
/ LOW complexity
Affected Products (20)
Api Control Plane
Open Banking Am
Affected Vendors
References (1)
42
/ 100
moderate-risk
Severity
15/34 · Moderate
Exploitability
7/34 · Low
Exposure
20/34 · Moderate