CVE-2024-10302

Analyzed Analyzed - Analysis Complete

User Self-Signup Input Validation Flaw in WSO2 Products

Publication date: 2026-08-06

Last updated on: 2026-08-09

Assigner: WSO2 LLC

Description

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-09

Generated

2026-08-26

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-25

NVD

CVE-2024-10302

EUVD

EUVD-2024-55708

Affected Vendors & Products

Vendor	Product	Version / Range
wso2	api_manager	3.1.0
wso2	identity_server_as_key_manager	5.10.0
wso2	identity_server	5.11.0
wso2	api_manager	4.0.0
wso2	api_manager	3.2.0
wso2	identity_server	5.10.0
wso2	open_banking_iam	2.0.0
wso2	api_manager	3.2.1
wso2	traffic_manager	4.5.0
wso2	universal_gateway	4.5.0
wso2	api_manager	4.2.0
wso2	api_manager	4.3.0
wso2	api_control_plane	4.5.0
wso2	api_manager	4.1.0
wso2	api_manager	4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The user self-signup feature in multiple WSO2 products does not properly validate user input. This allows attackers to submit arbitrary data that gets included in user claims without proper checks. These claims are then used by other parts of the application, potentially leading to security issues.

Detection Guidance

To detect this vulnerability, inspect WSO2 product logs for unusual user signup activities or malformed input data in user claims. Check for requests containing unexpected characters or payloads in self-signup endpoints. Review system logs for UI inconsistencies or unauthorized actions linked to user claims.

Impact Analysis

This vulnerability could allow attackers to manipulate user interface elements, redirect users to malicious sites, perform unauthorized actions, or expose sensitive data. The impact depends on how the compromised data is used by other parts of the application.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data exposure or manipulation through unvalidated user claims during self-signup. Malicious input could lead to data breaches or unauthorized actions, violating privacy and security requirements under these regulations.

Mitigation Strategies

Review and enhance input validation in the user self-signup flow of WSO2 products. Ensure all user-supplied data is properly sanitized and validated before processing. Implement strict claim validation to prevent arbitrary data injection.

Hi! I’m here to help you understand CVE-2024-10302. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70