CVE-2025-6670: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-6670 is a Cross-Site Request Forgery (CSRF) vulnerability affecting multiple WSO2 products due to the use of HTTP GET methods for state-changing operations within admin services, specifically in the event processor of the Carbon console. The vulnerability was published on November 18, 2025, and affects a broad range of WSO2 products including API Manager (versions 3.1.0–4.6.0), Identity Server (versions 5.10.0–7.2.0), Universal Gateway (4.5.0–4.6.0), Enterprise Integrator (6.6.0), Open Banking AM/IAM (2.0.0), API Control Plane (4.5.0–4.6.0), Traffic Manager (4.5.0–4.6.0), and Identity Server as Key Manager (5.10.0). It carries a CVSS v3.1 base score of 8.8 (High) (WSO2 Advisory, Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). The vulnerability arises because state-changing administrative operations in the WSO2 Carbon console's event processor are performed via HTTP GET requests rather than POST requests with CSRF tokens. Although the SameSite=Lax cookie attribute is applied, it is insufficient in this context because browsers permit cookies to be sent with cross-origin top-level navigations triggered by GET requests, effectively bypassing this protection. An attacker can craft a malicious URL that, when visited by an authenticated administrator, causes the browser to issue unintended GET-based state-changing requests to the Carbon console without any additional user interaction beyond clicking the link (WSO2 Advisory, Red Hat CVE).

Successful exploitation allows an unauthenticated attacker (requiring only that the victim is an authenticated admin) to perform unauthorized state-changing operations on the WSO2 Carbon console, including data modification, administrative account changes, and execution of unintended administrative actions. This can result in high impacts to confidentiality, integrity, and availability of the affected system. The scope of impact is broad given the number of affected WSO2 products spanning API management, identity, and integration platforms; however, WSO2's own Secure Production Guidelines recommend not exposing Carbon console services to untrusted networks, which would reduce exploitability in properly hardened deployments (WSO2 Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires user interaction — specifically, an authenticated administrator must be tricked into visiting a crafted link — which somewhat limits opportunistic exploitation (WSO2 Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible WSO2 Carbon console instances (e.g., via Shodan, Censys, or internal network scanning) running affected product versions such as WSO2 API Manager, Identity Server, or Enterprise Integrator.
2. Identify target endpoint: Locate the specific Carbon console admin service endpoint in the event processor that performs state-changing operations via HTTP GET (e.g., endpoints under /carbon/ or /admin/ paths).
3. Craft malicious URL: Construct a GET request URL targeting the vulnerable admin service endpoint with parameters that trigger the desired state-changing action (e.g., modifying a configuration, creating/deleting an account, or altering event processor settings).
4. Deliver the payload: Send the crafted URL to an authenticated WSO2 administrator via phishing email, social engineering, or embedding it in a webpage/document the target is likely to visit.
5. Trigger exploitation: When the authenticated administrator clicks the link or visits the page containing the embedded request, the browser automatically includes the session cookie (due to SameSite=Lax allowing cookies on top-level GET navigations), causing the Carbon console to execute the unintended administrative action on behalf of the victim (WSO2 Advisory).

• Logs: Unexpected HTTP GET requests to Carbon console admin service endpoints (e.g., paths under /carbon/, /admin/, or event processor URLs) originating from unusual referrer domains or with no referrer header in WSO2 access logs.
• Logs: Administrative actions (account changes, configuration modifications, event processor updates) recorded in WSO2 audit logs that do not correspond to known administrator activity or originate from unexpected session contexts.
• Network: Outbound or inbound HTTP GET requests to Carbon console admin endpoints from external or untrusted IP addresses, particularly if the console should only be accessible internally.
• Application: Unexpected changes to admin accounts, event processor configurations, or system settings in the WSO2 management console that cannot be attributed to legitimate administrator actions.

WSO2 has released patches addressing this vulnerability; administrators should apply the relevant updates for their product and version (e.g., API Manager 3.1.0 → 3.1.0.349+, 3.2.0 → 3.2.0.453+, 4.0.0 → 4.0.0.373+, 4.1.0 → 4.1.0.236+, 4.2.0 → 4.2.0.176+, 4.3.0 → 4.3.0.88+, 4.4.0 → 4.4.0.52+, 4.5.0 → 4.5.0.35+, 4.6.0 → 4.6.0.1+; Identity Server 5.10.0 → 5.10.0.378+, 5.11.0 → 5.11.0.425+, 6.0.0 → 6.0.0.252+, 6.1.0 → 6.1.0.253+, 7.0.0 → 7.0.0.130+, 7.1.0 → 7.1.0.38+, 7.2.0 → 7.2.0.1+; and corresponding fixes for other affected products). As an immediate workaround, restrict access to the Carbon console to trusted internal networks only, implement network segmentation, and consider adding additional CSRF protections such as anti-CSRF tokens for state-changing operations. Disabling or closely monitoring admin services exposed to untrusted networks is also recommended per WSO2 Secure Production Guidelines (WSO2 Advisory).

The vulnerability was noted by automated CVE tracking services and vulnerability databases shortly after publication in November 2025, including mentions on Bluesky CVE feeds and CIRCL vulnerability lookup. Red Hat also tracked the CVE in their security advisory database. No significant independent researcher commentary, vendor blog posts, or major media coverage has been identified beyond standard CVE aggregation (Red Hat CVE).