{"id":"CVE-2024-4989","kind":"vulnerability","aliases":["CVE-2024-4989"],"related":[],"title":"WSO2 API Manager: callback URL parameter enables open redirect phishing","description":"The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.\n\nExploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.","summary":"The callback URL parameter in WSO2 API Manager does not validate user input, so an attacker can make it send users to any web page. That open redirect can be used in phishing to steal sensitive information.","severity":"medium","cvss":5.4,"epss":0.00169,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","infrastructure","self-hosted","wso2"],"not_affected_if":[],"how_to_check":"- Confirm whether WSO2 API Manager is deployed, for example by checking the installed product version with the vendor's version file or admin console.\n- unknown","fix":"- Upgrade WSO2 API Manager to a fixed release, as listed in the vendor advisory linked from NVD (version unknown from sources).\n- unknown","status":"open","published_at":"2026-10-21T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:14:35+00:00","updated_at":"2026-10-25T04:14:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:14:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WSO2 API Manager to a fixed release, as listed in the vendor advisory linked from NVD (version unknown from sources).\n- unknown","reach":"internet","title":"WSO2 API Manager: callback URL parameter enables open redirect phishing","impact":"low","summary":"The callback URL parameter in WSO2 API Manager does not validate user input, so an attacker can make it send users to any web page. That open redirect can be used in phishing to steal sensitive information.","category":"infrastructure","nicknames":[],"who_cares":["wso2","api-gateway","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Users are redirected to attacker pages used for phishing","analyst_note":"Find the affected and fixed WSO2 API Manager versions and any required configuration in the vendor advisory linked from NVD.","how_to_check":"- Confirm whether WSO2 API Manager is deployed, for example by checking the installed product version with the vendor's version file or admin console.\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run WSO2 API Manager and expose its callback URL parameter to users. The sources do not say which versions or configurations are affected, so check the vendor advisory before assuming exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000586,"input_tokens":3404,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':12A,15A '-4989':13A,16A 'acquir':126C 'actor':84C 'aim':124C 'allow':77C 'api':2A,18B,31B,68C 'api-gateway':17B 'attack':40B,97C,123C 'attacker-control':96C 'callback':4A,26B,63C 'caus':130C 'conjunct':106C 'control':81C,98C 'could':89C 'cve':11A,14A 'enabl':7A 'engin':109C 'exploit':85C 'fail':70C 'gateway':19B 'harm':132C 'host':23B 'inform':61B,128C 'infrastructur':20B 'input':37B,76C 'interact':115C 'lead':90C 'link':118C 'make':42B 'malici':83C,117C 'manag':3A,32B,69C 'open':8A,51B 'page':49B,100C 'paramet':6A,28B,65C 'phish':10A,57B,122C 'potenti':119C 'redirect':9A,52B,94C 'result':120C 'self':22B 'self-host':21B 'send':44B 'sensit':60B,127C 'social':108C 'steal':59B 'suppli':75C 'techniqu':110C 'trick':112C 'url':5A,27B,64C 'use':55B,104C 'user':36B,45B,74C,92C,113C 'user-suppli':73C 'valid':35B,72C 'vulner':88C 'web':48B,99C 'wso2':1A,24B,30B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams that run WSO2 API Manager and expose its callback URL parameter to users. The sources do not say which versions or configurations are affected, so check the vendor advisory before assuming exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-4989","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4989","severity":null,"published_at":"2026-10-21T14:17:04+00:00","modified_at":"2026-10-21T18:37:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2024-4989","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4989","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}