---
id: "CVE-2024-4989"
kind: "vulnerability"
aliases: ["CVE-2024-4989"]
title: "WSO2 API Manager: callback URL parameter enables open redirect phishing"
severity: "medium"
cvss: 5.4
epss: 0.00169
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api-gateway", "infrastructure", "self-hosted", "wso2"]
not_affected_if: []
published_at: "2026-10-21T14:17:04+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:14:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4989", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-4989", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WSO2 API Manager: callback URL parameter enables open redirect phishing

The callback URL parameter in WSO2 API Manager does not validate user input, so an attacker can make it send users to any web page. That open redirect can be used in phishing to steal sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether WSO2 API Manager is deployed, for example by checking the installed product version with the vendor's version file or admin console.
- unknown

## Fix

- Upgrade WSO2 API Manager to a fixed release, as listed in the vendor advisory linked from NVD (version unknown from sources).
- unknown

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-4989
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2024-4989

## From the sources

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.

Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_