WSO2 Patches High Severity SCIM Authorization Flaw in Identity Server and IAM Products

WSO2 has released security updates for several identity management products to address a high severity authorization flaw in SCIM endpoints. The vulnerability, tracked as CVE-2025-10149, allows federated users to execute actions on local user accounts when usernames match.

What happened

The National Vulnerability Database rates CVE-2025-10149 as high severity with a CVSS score of 8.2. The flaw involves insufficient authorization validation for federated users within the SCIM 2.0 and SCIM 1.1 endpoints. According to the NVD record, the issue arises when a local user and a federated user share the same username.

An attacker authenticated as a federated user can perform arbitrary operations on the local user account. This capability could lead to user account takeover, allowing the malicious actor to assume control of the local identity. The weaknesses are classified under CWE-281 and CWE-668, indicating improper preservation of permissions and error handling issues in the authorization logic.

Deployments that do not support user self-registration are considered medium severity by the NVD. This distinction reflects the reduced attack surface in environments where users cannot independently create accounts that might collide with federated identities.

Why it matters

WSO2 Identity Server versions before 5.10.0.379, before 5.11.0.415, and before 6.0.0.251 are affected. The update also covers WSO2 Identity Server as Key Manager before version 5.10.0.370 and WSO2 Open Banking IAM before version 2.0.0.419. Organizations using these specific releases must apply the updates to mitigate the risk.

The flaw also impacts underlying shared components. WSO2 Carbon SCIM Common Component versions before 5.6.0.1, before 5.6.1.2, before 5.7.0.3, and before 5.7.1.1 require patching. Similarly, WSO2 Carbon SCIM 2.0 Common Component versions before 1.5.1.40 and before 1.5.46.47 are vulnerable. As Patch Gazette noted in earlier reporting, identity server flaws often cascade across platforms using shared authentication libraries, emphasizing the need to track component-level updates.

What to watch

• Monitor internal logs for SCIM endpoint activity involving federated users with usernames matching local accounts.
• Review access patterns for unexpected administrative actions performed by federated identities.
• Check for any evidence of account takeover attempts or privilege escalation on local user profiles.
• Verify that all SCIM endpoints are enforcing strict authorization checks before processing requests.

Who needs to act first

Teams should prioritize updating systems exposed to external federated identity providers first. Check whether your environment allows username collisions between local and federated users. If you use self-registration, the risk is higher, so act immediately. Isolate affected SCIM endpoints if possible while preparing updates. Test the patched versions in a staging environment before rolling them out to production. Ensure backups are current before applying the changes. Communicate with security operations centers to monitor for anomalous SCIM activity during the transition. This approach minimizes exposure while ensuring system stability during the remediation process.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: WSO2

• Inventory all instances of WSO2 Identity Server, Open Banking IAM, and Carbon SCIM components to identify vulnerable versions.
• Apply the latest vendor patches to bring systems above the affected version thresholds listed in the advisory.
• Restrict SCIM endpoint access to trusted networks or IP ranges if immediate patching is not possible.
• Monitor authentication logs for federated users performing operations on local accounts with identical usernames.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which WSO2 products are affected by CVE-2025-10149?

WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Carbon SCIM Common Component, and WSO2 Carbon SCIM 2.0 Common Component are affected in specific prior versions.

Is there a fix available for this vulnerability?

Yes, WSO2 has released updated versions for all affected products that patch the authorization flaw in the SCIM endpoints.

What is the severity rating of CVE-2025-10149?

The NVD rates the vulnerability as high severity with a CVSS score of 8.2, though it is medium for deployments without self-registration.