CVE-2024-12141
Deferred Deferred - Pending Action

Open Redirect Vulnerability in Product

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: WSO2 LLC

Description
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2024-12141

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves insufficient validation of callback URLs, allowing attackers to manipulate them with malicious payloads. This happens either through weak regular expressions or omitted validation. Attackers craft links that seem legitimate but redirect users to attacker-controlled pages, enabling phishing attacks.

Impact Analysis

This vulnerability can lead to phishing attacks where users are tricked into visiting malicious sites. This may result in the theft of sensitive user information, unauthorized access to accounts, or data breaches. Users could unknowingly expose credentials or personal data.

Mitigation Strategies

Validate and sanitize all callback URLs using strict regular expressions or allowlists. Ensure proper input validation is enforced server-side to prevent malicious payloads. Update WSO2 Identity Server to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-12141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...