Live › vulnerability › CVE-2024-4989
Go to dashboardThe callback URL parameter in WSO2 API Manager does not validate user input, so an attacker can make it send users to any web page. That open redirect can be used in phishing to steal sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run WSO2 API Manager and expose its callback URL parameter to users. The sources do not say which versions or configurations are affected, so check the vendor advisory before assuming exposure.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.
Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
This page as .md · .json · in your agent: get_signal("CVE-2024-4989")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.