{"cve":"CVE-2024-6914","nvd":{"published":"2025-05-22T19:15:42.853","modified":"2026-06-17T08:18:58.130","status":"Analyzed","description":"An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges.\n\nThis vulnerability is exploitable only through the account recovery SOAP admin services exposed via the \"/services\" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the \"Security Guidelines for Production Deployment\" by disabling exposure to untrusted networks.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-863"],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561/","https://security.docs.wso2.com/en/latest/security-guidelines/security-guidelines-for-production-deployment/"],"products":["wso2:api_manager","wso2:identity_server","wso2:identity_server_as_key_manager","wso2:open_banking_am","wso2:open_banking_iam","wso2:open_banking_km"],"source":"nvd","synced_at":"2026-10-19T22:01:57.636215869+00:00"},"epss":{"cve":"CVE-2024-6914","score":0.00754,"percentile":0.55103,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}