CVE-2025-6670: CSRF in WSO2 Open Banking AM
Platform
java
Component
wso2-open-banking-am
Fixed in
4.5.0.34
4.6.0.1
4.5.0.34
4.6.0.1
4.5.0.36
4.6.0.1
3.1.0.349
3.2.0.453
3.2.1.73
4.0.0.373
4.1.0.236
4.2.0.176
4.3.0.88
4.4.0.52
4.5.0.35
4.6.0.1
5.10.0.378
5.11.0.425
6.0.0.252
6.1.0.253
7.0.0.130
7.1.0.38
7.2.0.1
5.10.0.369
6.6.0.226
4.5.3.50
4.6.0.2253
4.6.1.157
4.6.2.673
4.6.3.41
4.6.4.22
4.7.1.73
4.8.1.43
4.9.0.106
4.9.26.31
4.9.27.16
4.9.28.18
4.9.33.2
4.10.9.75
4.10.42.18
4.10.101.3
CVE-2025-6670 describes a Cross-Site Request Forgery (CSRF) vulnerability found in WSO2 Open Banking AM. This vulnerability allows an attacker to potentially manipulate an authenticated user's session and perform unauthorized actions within the admin services. The issue stems from the use of HTTP GET requests for state-changing operations, bypassing the effectiveness of the SameSite cookie attribute. Affected versions include those prior to 7.2.0.1, and a fix is available in version 7.2.0.1.
Detect this CVE in your project
Upload your pom.xml file and we'll tell you instantly if you're affected.
Impact and Attack Scenarios
An attacker can exploit this CSRF vulnerability by crafting a malicious link and enticing an authenticated user to click it. Upon clicking, the user's browser will unknowingly send a request to the WSO2 Open Banking AM server, executing the attacker's intended action. This could involve modifying configurations, creating or deleting users, or performing other administrative tasks without the user's explicit consent. The potential impact is significant, as a successful exploit could lead to unauthorized access and control over the WSO2 Open Banking AM instance, potentially compromising sensitive data and disrupting services. The reliance on GET requests for state changes, despite the presence of SameSite cookies, is the root cause, making this a particularly concerning vulnerability.
Exploitation Context
CVE-2025-6670 was publicly disclosed on 2025-11-18. The vulnerability's reliance on GET requests for state changes, while employing SameSite cookies, presents a unique exploitation challenge. Currently, there are no publicly available proof-of-concept exploits, but the vulnerability's ease of exploitation makes it a potential target for opportunistic attackers. It is not currently listed on the CISA KEV catalog. The CVSS score of 8.8 (HIGH) reflects the potential for significant impact.
Threat Intelligence
Exploit Status
EPSS
0.04% (10% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2025-6670 is to upgrade WSO2 Open Banking AM to version 7.2.0.1 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds to reduce the attack surface. These may include restricting access to admin services to trusted networks, implementing stricter input validation on all admin endpoints, and carefully reviewing any third-party integrations that interact with the admin console. While SameSite cookies are present, their ineffectiveness in this scenario highlights the importance of using POST requests for state-changing operations. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the request is blocked or ignored.
How to fix
Update to the latest version of WSO2 Open Banking AM that contains the fix for the CSRF vulnerability. Ensure that Carbon console services are not exposed to untrusted networks, following the WSO2 Secure Production Guidelines.
CVE Security Newsletter
Vulnerability analysis and critical alerts directly to your inbox.
Frequently asked questions
What is CVE-2025-6670 — CSRF in WSO2 Open Banking AM?
CVE-2025-6670 is a Cross-Site Request Forgery (CSRF) vulnerability in WSO2 Open Banking AM versions prior to 7.2.0.1, allowing attackers to perform unauthorized actions via crafted links.
Am I affected by CVE-2025-6670 in WSO2 Open Banking AM?
Yes, if you are running WSO2 Open Banking AM versions earlier than 7.2.0.1, you are potentially affected by this CSRF vulnerability.
How do I fix CVE-2025-6670 in WSO2 Open Banking AM?
Upgrade WSO2 Open Banking AM to version 7.2.0.1 or later to resolve the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
Is CVE-2025-6670 being actively exploited?
While no public exploits are currently known, the vulnerability's ease of exploitation makes it a potential target for attackers.
Where can I find the official WSO2 advisory for CVE-2025-6670?
Refer to the official WSO2 security advisory for detailed information and updates regarding CVE-2025-6670: [https://wso2.com/en/security/vulnerabilities/cve-2025-6670/](https://wso2.com/en/security/vulnerabilities/cve-2025-6670/)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.