shouldiuse.io

Categories

VERDICT

WSO2 Review

Depends

Should I use WSO2?

Open-source API management, identity, and integration platform - wso2.com

· 1 month ago

WSO2 fits large engineering orgs that need full-lifecycle API management, identity, and integration under one open-source roof. Small teams or shops without dedicated middleware and Java engineers should pick a lighter tool.

Confidence

High. Based on ~50 public sources: G2/Gartner reviews, security advisories, Reddit threads, and vendor case studies.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support quality evidence found
  • Security posture

Pricing

$0

Open Source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
SubscriptionUsage-based, quote only
Managed Cloud~$65k+/yr example

Best for

  • Large engineering organizations
  • API-first enterprises
  • Banks and telecoms with compliance needs
  • Teams wanting open-source IAM

Not for

  • Small teams needing a simple API gateway
  • Startups without dedicated middleware engineers
  • Non-Java shops unwilling to maintain a Java stack
  • Buyers who need transparent, published pricing

Gotchas - check before you buy

high

CVE-2022-29464 was a critical remote code execution flaw in API Manager; verify patch levels before self-hosting.

high

2025 authentication-bypass CVEs (9152, 9804, 10611) disclosed across WSO2 products; patch fast.

medium

Managed cloud runs roughly $65,000/year plus a 25% hosting fee; expect sales-driven quotes.

medium

Lock-in: users report painful exit after standardizing on the WSO2 ecosystem.

Pros and cons

Pros

  • Rated 4.5/5 across 301 verified G2 reviews
  • Broad protocol and integration support across the stack
  • Free open-source core lowers entry cost
  • Named a Leader in API management by analysts and G2
  • Users say it solved API governance and management problems

Cons

  • Users report being boxed into the WSO2 ecosystem
  • Pricing is hard to get and opaque
  • Primarily Java-oriented; needs Java skills in-house
  • Massive full-lifecycle suite with a heavy footprint
  • History of critical CVEs, including authentication bypasses

Sources & method

- 10 sources - Active advisory program, but repeated critical CVEs (RCE, auth bypass) mean strict patch discipline is mandatory.

official x2review x3security x3news x2
  • CVE-2022-29464 — API Manager remote code execution, Remote code execution vulnerability in WSO2 API Manager, disclosed by SentinelOne.
  • Multiple authentication-bypass CVEs (2025), CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804 allow bypassing authentication in WSO2 products, per researcher writeup.
  • Critical vulnerabilities in WSO2 Identity Server, SEC Consult reported multiple critical issues, including reflected XSS (IDENTITY-3280).

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 3/5. Free OSS core, but opaque enterprise pricing
  • Ease of use: 2/5. Massive full-lifecycle hub; steep learning curve
  • Feature depth: 5/5. Broad protocols, APIs, IAM, integration in one suite
  • Support quality. No support quality evidence found
  • Security posture: 2/5. Repeated critical CVEs despite active advisory program
  • 4.5/5 G2 rating 301 verified reviews
  • $0 Starting price Open-source core, self-hosted
  • 950+ Customers Worldwide since 2005
  • $159.5M Total funding 7 rounds; $93M Series E

Pricing

Open Source

$0

  • Self-hosted core products
  • Community Slack support
  • Own the patching burden

Subscription

Usage-based, quote only

  • Production support and updates
  • Pricing not published
  • Sales-negotiated

Managed Cloud

~$65k+/yr example

  • Hosted deployment
  • +25% managed hosting fee
  • Micro annual plan available

Security

Active advisory program, but repeated critical CVEs (RCE, auth bypass) mean strict patch discipline is mandatory.

  • CVE-2022-29464 — API Manager remote code executionRemote code execution vulnerability in WSO2 API Manager, disclosed by SentinelOne.³
  • Multiple authentication-bypass CVEs (2025)CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804 allow bypassing authentication in WSO2 products, per researcher writeup.⁴
  • Critical vulnerabilities in WSO2 Identity ServerSEC Consult reported multiple critical issues, including reflected XSS (IDENTITY-3280).⁵

What users say

Users praise flexibility and API governance but warn about ecosystem lock-in and a heavy, Java-centric stack.

“What I like best about WSO2 API Platform is its flexibility”
G2, WSO2 API Platform review
“WSO2 solved all problems with API governance and management”
AWS Marketplace review
“the only issue with wso2 was u just get boxed into the wso2 ecosystem”
Reddit, r/srilanka

Alternatives

Compare WSO2 with each alternative.

  • AWS API Gateway

    Top Gartner-listed alternative if you are already on AWS.

Companies that use it

  • Qantas
  • NCELL
  • Royal Government of Bhutan
  • Karnataka Bank
  • Ten Fuel
Full analysis

Based on ~50 public sources: G2/Gartner reviews, security advisories, Reddit threads, and vendor case studies.

Powerful open-source API, identity, and integration suite for big engineering teams — heavy for everyone else. Mind the CVE history.

Methodology

Based on ~50 public sources: G2/Gartner reviews, security advisories, Reddit threads, and vendor case studies.

Read how a report is made.

Sources

  1. WSO2 seller reviews on G2 (301 reviews, 4.5 stars)g2.com
    review
  2. WSO2 reviews on Gartner (application integration platforms)gartner.com
    review
  3. CVE-2022-29464: WSO2 API Manager RCE Vulnerabilitysentinelone.com
    security
  4. The many ways to bypass authentication in WSO2 productscrnkovic.dev
    security
  5. Multiple critical vulnerabilities in WSO2 Identity Serversec-consult.com
    security
  6. WSO2 Subscription Service Definition and FAQwso2.com
    official
  7. WSO2 Customer Stories (950+ customers)wso2.com
    official
  8. WSO2 subscription pricing overview (managed cloud ~$65k)scribd.com
    news
  9. WSO2 funding and IPO profileforgeglobal.com
    news
  10. Reddit: worst IT companies thread (lock-in commentary)reddit.com
    review

Add this review to your site

This check for WSO2 says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends WSO2 Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.