CVE-2024-7487: Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication

Published May 22, 2025

Updated

An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed.

Exploitation of this vulnerability could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.

Affected Software

2 affected components

WSO2 Identity Server=7.0.0

Remediation

Information

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3348/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3348/#solution

Event History

May 22, 2025

CVE Published

via MITRE·07:03 PM

Data Sourced

via MITRE·07:03 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-7487?

The severity of CVE-2024-7487 is critical due to its potential to allow unauthorized authentication bypass.

How do I fix CVE-2024-7487?

To remediate CVE-2024-7487, upgrade WSO2 Identity Server to a patched version that addresses the authentication flaw.

What are the consequences of exploiting CVE-2024-7487?

Exploitation of CVE-2024-7487 can enable attackers to bypass authentication mechanisms and gain unauthorized access to resources.

Which version of WSO2 Identity Server is affected by CVE-2024-7487?

WSO2 Identity Server version 7.0.0 is the only affected version for CVE-2024-7487.

Is CVE-2024-7487 related to any other vulnerabilities?

CVE-2024-7487 is a standalone vulnerability but highlights broader concerns regarding authentication implementations.