Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

WSO2 Identity Server can be tricked to miss security checks

published 5 days ago
Summary

The WSO2 Identity Server component uses an outdated version of the Bouncy Castle library for Java. Because the library is vulnerable, an attacker could potentially bypass security controls or tamper with data. Update the Bouncy Castle library to the latest version or apply the vendor’s security patch as soon as possible.

What to do
  • Update cleanstart wso2is to version 7.1.0-r1.
  • Update cleanstart wso2is to version 7.2.0-r1.
  • Update cleanstart wso2is to version 7.3.0-r1.
  • Update cleanstart wso2is to version 7.0.0-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart wso2is < 7.1.0-r1
< 7.2.0-r1
< 7.3.0-r1
< 7.0.0-r1
Fix: upgrade to 7.1.0-r1
Original advisory text
In Bouncy Castle for Java before 1
Security vulnerability affects the wso2is package. In Bouncy Castle for Java before 1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.3 High
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-QY34114 · OSV
Track software like this
Free during beta