CVE-2024-6914

CRITICAL

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnera...

Affects 6 products across 1 vendor.

CVSS 3.19.8
EPSS0.7%
Percentile53th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-863: Incorrect Authorization

Software performs an authorization check incorrectly, allowing access beyond intended privileges.

◆ AI Analysis — automated analysis, not human-reviewed

An incorrect authorization vulnerability in multiple WSO2 products allows a malicious actor to reset the password of any user account, including those with elevated privileges, through the account recovery-related SOAP admin service.

BSID: BS-2025-GLOBAL-039581-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-6914?
An incorrect authorization vulnerability in multiple WSO2 products allows a malicious actor to reset the password of any user account, including those with elevated privileges, through the account recovery-related SOAP admin service.
What is the CVSS score for CVE-2024-6914?
CVE-2024-6914 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.7%.
Is CVE-2024-6914 actively exploited?
No confirmed active exploitation of CVE-2024-6914 as of 2026-05-30.
How do I remediate CVE-2024-6914?
Priority: IMMEDIATE. Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561/ PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
What systems are affected by CVE-2024-6914?
CVE-2024-6914 affects Wso2 Identity Server, Api Manager, Identity Server As Key Manager, Open Banking Am, Open Banking Iam, Open Banking Km.
Vulnerability Details
CVE IDCVE-2024-6914
BSIDBS-2025-GLOBAL-039581-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-05-22
Last Modified2025-10-06
ICS Relevance15%
Weakness (CWE)
Incorrect Authorization
SourceNVD
Official Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by sending a specially crafted SOAP request to the account recovery service, which incorrectly authorizes the password reset request for any user account.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Wso2 Identity Server 5.3.0 5.4.0 5.4.1 5.5.0 5.6.0 5.7.0
+7 more5.8.0 5.9.0 5.10.0 5.11.0 6.0.0 6.1.0 7.0.0
Wso2 Api Manager 2.2.0 2.5.0 2.6.0 3.0.0 3.1.0 3.2.0
+5 more3.2.1 4.0.0 4.1.0 4.2.0 4.3.0
Wso2 Identity Server As Key Manager 5.3.0 5.5.0 5.6.0 5.7.0 5.9.0 5.10.0
Wso2 Open Banking Am 1.3.0 1.4.0 1.5.0 2.0.0
Wso2 Open Banking Iam 2.0.0
Wso2 Open Banking Km 1.3.0 1.4.0 1.5.0
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 511 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash20badfb3b242d3d3fa75c238c9ceae5aa3129febb0c563337191be411d6f6ba996e7f6b68d3f0a3d53b915f9b1b6548c7c5b021aedf526d8b2721b13b038eb1c
Related CVEs affecting Wso2
CVE-2026-5430 10.0 The JWT authentication mechanism accepts tokens signed with algorithms other ... CVE-2026-2053 10.0 The WSO2 API Manager's message flow component, when processing WS-Addressing ... CVE-2025-9152 9.8 An improper privilege management vulnerability exists in WSO2 API Manager due... CVE-2020-13226 9.8 WSO2 API Manager 3.0.0 does not properly restrict outbound network access fro... CVE-2022-29464 9.8 Certain WSO2 products allow unrestricted file upload with resultant remote co...
View all Wso2 CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →