WSO2 Identity Server - Authentication Bypass (CVE-2025-5605)
Description
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.
The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
psychologyCrowdSec Analysis
CVE-2025-5605 is an authentication bypass vulnerability affecting the Management Console of several WSO2 products, allowing attackers to manipulate request URIs and gain unauthorized access to restricted resources. While the exposure is limited to partial information disclosure, such as memory statistics, this flaw could aid attackers in gathering internal system details for further exploitation or reconnaissance.
CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-5605 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-5605 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-5605 is currently experiencing high visibility and active exploitation across the internet.
Attackers exploit authentication bypass by requesting URLs such as /carbon/server-admin/memory_info.jsp;.jar, manipulating the URI to gain unauthorized access to internal memory statistics on WSO2 Management Console endpoints.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-10-24 |
| Rule Released | 2025-11-26 |
| CrowdSec First Seen | 2025-11-28 |