CVE-2024-10302: WSO2 Products Auth Bypass Vulnerability

CVE-2024-10302 Overview

CVE-2024-10302 affects the user self-signup flow across multiple WSO2 products. The flow fails to adequately validate user-supplied input before storing it in user claims. Downstream processes then consume these claims without sanitization, extending the impact beyond the signup component itself.

Attackers can inject arbitrary unvalidated data into user claims during account registration. The compromised claim data may enable content manipulation, redirection, user interface inconsistencies, unauthorized actions, or data exposure. Exact impact depends on how downstream components consume the claim data and the privileges of the affected users. The weakness is tracked under CWE-20 Improper Input Validation.

Critical Impact
Unauthenticated attackers can inject unvalidated data into user claims during self-signup, affecting downstream processes that trust claim contents.

Affected Products

Multiple WSO2 products with the user self-signup flow enabled
Refer to the WSO2 Security Advisory 2024-3740 for the authoritative product and version list

Discovery Timeline

2026-08-06 - CVE-2024-10302 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2024-10302

Vulnerability Analysis

The self-signup component accepts registration data from unauthenticated users through a network-facing endpoint. The component stores supplied fields directly into user claim attributes without applying validation, encoding, or type constraints. Claims are identity attributes referenced by authentication flows, authorization decisions, and rendered UI elements across the WSO2 product family.

Because claim data crosses trust boundaries, downstream services treat these values as trusted identity metadata. Attackers can supply malformed strings, scripting payloads, or unexpected structural content within claim fields. When another component reads the claim to render output or make a policy decision, the injected content executes in that component's context.

The scope change reflected in the CVSS vector indicates that impact extends to components other than the signup form itself. Exploitation complexity is rated High because success depends on which downstream consumers process the tainted claim and how they handle it.

Root Cause

The root cause is missing input validation in the self-signup handler. User-supplied claim values are accepted and persisted without allowlist validation, length constraints, or output-context encoding at the storage boundary. The design relies on downstream consumers to sanitize claim data, which is not consistently enforced.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a crafted self-signup request containing malicious content in fields such as display name, email, or custom claim attributes. The account is created with the tainted claim data. When an administrator, another user, or a downstream service later processes the claim, the injected content triggers the secondary behavior. This chain of trust across components is what enables cross-component impact from a low-privilege registration action.

No public proof-of-concept code is available for this issue. See the WSO2 Security Advisory 2024-3740 for vendor technical details.

Detection Methods for CVE-2024-10302

Indicators of Compromise

Self-signup requests to WSO2 endpoints containing scripting payloads, HTML tags, or control characters in claim fields
Newly created user accounts with claim values containing non-printable characters, URL fragments, or unusually long strings
Administrative console pages rendering unexpected content sourced from user claim attributes
Redirect responses whose target is derived from a user claim field

Detection Strategies

Inspect WSO2 audit and application logs for self-signup requests that include markup, JavaScript keywords, or template expressions in claim parameters
Query the user store for accounts whose claims contain characters outside the expected charset for that attribute
Correlate account creation events with subsequent claim reads by downstream services to identify suspicious propagation

Monitoring Recommendations

Enable verbose logging on the WSO2 self-signup and user store components to capture raw claim values submitted at registration
Alert on registration bursts from single source addresses targeting the self-signup endpoint
Monitor administrative UI rendering errors and Content Security Policy violations that reference user claim data

How to Mitigate CVE-2024-10302

Immediate Actions Required

Apply the fixes referenced in WSO2 Security Advisory 2024-3740 to all affected WSO2 deployments
Disable the user self-signup feature on internet-facing WSO2 instances until patches are validated in staging
Audit existing accounts created via self-signup and sanitize or remove claim values containing untrusted content

Patch Information

WSO2 has published remediation guidance in Security Advisory 2024-3740. Consult the advisory for product-specific patch versions, WUM updates, and configuration changes required to enforce claim validation.

Workarounds

Turn off self-signup in the identity server configuration where the feature is not required
Restrict access to self-signup endpoints using a reverse proxy or web application firewall rule set that validates claim field contents
Enforce allowlist input validation on custom claim dialects before persisting values to the user store

bash

# Configuration example: disable self-signup in WSO2 Identity Server
# Edit <IS_HOME>/repository/conf/deployment.toml
[identity_mgt.user_self_registration]
allow_self_registration = false