CVE-2026-0637
Modified
Modified - Updated After Analysis
Information Disclosure in WSO2 Carbon via Misconfigured Logs
Vulnerability report for CVE-2026-0637, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-06
Last updated on: 2026-11-04
Assigner: WSO2 LLC
Description
Description
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.
An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_manager | From 3.2.0 (inc) to 3.2.0.465 (exc) |
| wso2 | api_manager | From 3.2.1 (inc) to 3.2.1.84 (exc) |
| wso2 | api_manager | From 4.2.0 (inc) to 4.2.0.189 (exc) |
| wso2 | api_control_plane | From 4.5.0 (inc) to 4.5.0.50 (exc) |
| wso2 | api_control_plane | From 4.6.0 (inc) to 4.6.0.14 (exc) |
| wso2 | api_manager | From 3.1.0 (inc) to 3.1.0.357 (exc) |
| wso2 | api_manager | From 4.1.0 (inc) to 4.1.0.249 (exc) |
| wso2 | api_manager | From 4.3.0 (inc) to 4.3.0.100 (exc) |
| wso2 | api_manager | From 4.4.0 (inc) to 4.4.0.64 (exc) |
| wso2 | api_manager | From 4.5.0 (inc) to 4.5.0.49 (exc) |
| wso2 | api_manager | From 4.6.0 (inc) to 4.6.0.13 (exc) |
| wso2 | identity_server | From 5.10.0 (inc) to 5.10.0.386 (exc) |
| wso2 | identity_server | From 5.11.0 (inc) to 5.11.0.433 (exc) |
| wso2 | identity_server | From 6.0.0 (inc) to 6.0.0.260 (exc) |
| wso2 | identity_server | From 6.1.0 (inc) to 6.1.0.261 (exc) |
| wso2 | identity_server_as_key_manager | From 5.10.0 (inc) to 5.10.0.377 (exc) |
| wso2 | open_banking_am | From 2.0.0 (inc) to 2.0.0.406 (exc) |
| wso2 | open_banking_iam | From 2.0.0 (inc) to 2.0.0.426 (exc) |
| wso2 | traffic_manager | From 4.5.0 (inc) to 4.5.0.48 (exc) |
| wso2 | traffic_manager | From 4.6.0 (inc) to 4.6.0.13 (exc) |
| wso2 | universal_gateway | From 4.5.0 (inc) to 4.5.0.49 (exc) |
| wso2 | universal_gateway | From 4.6.0 (inc) to 4.6.0.13 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
