CVE-2025-13394: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax processor of the WSO2 Carbon console that allows unauthenticated attackers to trick authenticated users into executing unauthorized state-changing operations. The vulnerability was published on August 6, 2026, and affects a broad range of WSO2 products including API Manager (versions 3.1.0–4.6.0), Identity Server (versions 5.10.0–7.2.0), Enterprise Integrator (6.6.0), API Control Plane (4.5.0–4.6.0), Traffic Manager (4.5.0–4.6.0), Universal Gateway (4.5.0–4.6.0), Open Banking IAM (2.0.0), Open Banking AM (2.0.0), and Identity Server as Key Manager (5.10.0). It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, WSO2 Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). The Carbon console's Ajax processor uses HTTP GET requests for state-changing operations — a design flaw that undermines the SameSite=Lax cookie mitigation, since browsers permit cookies to be sent with cross-origin top-level GET navigation requests. An attacker can craft a malicious webpage that, when visited by an authenticated Carbon console user, silently issues GET requests to the console's Ajax endpoints, causing the server to process them as legitimate user actions. No authentication or special privileges are required on the attacker's side; only user interaction (visiting the malicious page) is needed (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an attacker to perform unauthorized state-altering operations on behalf of an authenticated Carbon console user, including data modification, account configuration changes, and other administrative actions. The confidentiality impact is rated None, while integrity and availability are both rated Low, meaning the attacker cannot directly read sensitive data but can alter or disrupt it. Exploitation is contingent on the Carbon console being exposed to the public internet, which WSO2 explicitly advises against in its security guidelines (GitHub Advisory, WSO2 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.097% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact.

1. Reconnaissance: Identify publicly accessible WSO2 Carbon console instances (e.g., via Shodan or Censys) running affected product versions.
2. Identify target endpoints: Enumerate Carbon console Ajax processor endpoints that perform state-changing operations via HTTP GET requests (e.g., user management, configuration changes).
3. Craft malicious page: Create a webpage containing an <img>, <a>, or <script> tag that issues a cross-origin GET request to the target Carbon console Ajax endpoint with the desired state-changing parameters.
4. Deliver to victim: Trick an authenticated Carbon console administrator into visiting the malicious page (e.g., via phishing email or malicious link).
5. CSRF execution: The victim's browser automatically sends the GET request to the Carbon console, including the session cookie (permitted under SameSite=Lax for top-level navigation), causing the server to execute the unintended state-changing action on behalf of the authenticated user (GitHub Advisory, WSO2 Advisory).

• Logs: Unexpected GET requests to Carbon console Ajax processor endpoints originating from unusual referrer URLs or external origins in web access logs; administrative actions (user changes, configuration updates) logged without corresponding user-initiated sessions.
• Network: HTTP GET requests to Carbon console management endpoints from IP addresses not associated with known administrators; requests with Referer headers pointing to external or unknown domains.
• Behavioral: Unexplained changes to user account settings, role assignments, or system configurations in the Carbon console audit logs without corresponding administrator activity.

WSO2 has released patched versions for all affected products; administrators should upgrade to the fixed builds (e.g., API Manager ≥ 4.6.0.3, Identity Server ≥ 7.2.0.3, Enterprise Integrator ≥ 6.6.0.227, and corresponding fixed builds for other affected products as detailed in the advisory) (WSO2 Advisory). As a critical workaround, WSO2 strongly recommends not exposing the Carbon console to the public internet — restricting access to trusted internal networks significantly eliminates the attack surface. Additional hardening measures include implementing synchronizer token-based CSRF protections, enforcing stricter cookie attributes (e.g., SameSite=Strict), and applying network-level access controls (firewalls, VPNs) to the Carbon console management interface.

WSO2 published a formal security advisory (WSO2-2025-4800) addressing the vulnerability and reiterating its security guideline that the Carbon console should not be internet-facing (WSO2 Advisory). The GitHub Advisory Database classified the vulnerability as Moderate severity. No significant independent researcher commentary, exploit releases, or notable media coverage has been observed at this time.