4.5/5
G2 rating
301 verified reviews
Report
Should I Use WSO2?
Open-source API management, identity, and integration platform
Depends
DependsWSO2 fits large engineering orgs that need full-lifecycle API management, identity, and integration under one open-source roof.
Powerful open-source API, identity, and integration suite for big engineering teams — heavy for everyone else. Mind the CVE history.
Confidence: High
$0
Starting price
Open-source core, self-hosted
950+
Customers
Worldwide since 2005
$159.5M
Total funding
7 rounds; $93M Series E
Value for money
3
Free OSS core, but opaque enterprise pricing
Ease of use
2
Massive full-lifecycle hub; steep learning curve
Feature depth
5
Broad protocols, APIs, IAM, integration in one suite
Security posture
2
Repeated critical CVEs despite active advisory program
Pros
Cons
Gotchas
- highCVE-2022-29464 was a critical remote code execution flaw in API Manager; verify patch levels before self-hosting.³
- high2025 authentication-bypass CVEs (9152, 9804, 10611) disclosed across WSO2 products; patch fast.⁴
- mediumManaged cloud runs roughly $65,000/year plus a 25% hosting fee; expect sales-driven quotes.⁸
- mediumLock-in: users report painful exit after standardizing on the WSO2 ecosystem.10
Best for
- Large engineering organizations
- API-first enterprises
- Banks and telecoms with compliance needs
- Teams wanting open-source IAM
Not for
- Small teams needing a simple API gateway
- Startups without dedicated middleware engineers
- Non-Java shops unwilling to maintain a Java stack
- Buyers who need transparent, published pricing
Companies that use it
- Qantas
- NCELL
- Royal Government of Bhutan
- Karnataka Bank
- Ten Fuel
Pricing
Open Source
$0
- Self-hosted core products
- Community Slack support
- Own the patching burden
Subscription
Usage-based, quote only
- Production support and updates
- Pricing not published
- Sales-negotiated
Managed Cloud
~$65k+/yr example
- Hosted deployment
- +25% managed hosting fee
- Micro annual plan available
Security
Active advisory program, but repeated critical CVEs (RCE, auth bypass) mean strict patch discipline is mandatory.
- CVE-2022-29464 — API Manager remote code executionRemote code execution vulnerability in WSO2 API Manager, disclosed by SentinelOne.³
- Multiple authentication-bypass CVEs (2025)CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804 allow bypassing authentication in WSO2 products, per researcher writeup.⁴
- Critical vulnerabilities in WSO2 Identity ServerSEC Consult reported multiple critical issues, including reflected XSS (IDENTITY-3280).⁵
What users say
Users praise flexibility and API governance but warn about ecosystem lock-in and a heavy, Java-centric stack.
“What I like best about WSO2 API Platform is its flexibility”
“WSO2 solved all problems with API governance and management”
“the only issue with wso2 was u just get boxed into the wso2 ecosystem”
Alternatives
Compare WSO2 with each alternative.
Tyk
Lighter, developer-friendly API gateway; simpler than WSO2's full suite.
DreamFactory
Instantly generates REST APIs from databases; much faster to start.
WSO2 vs DreamFactoryLoginRadius
Cloud-native CIAM alternative if you only need identity.
WSO2 vs LoginRadiusAWS API Gateway
Top Gartner-listed alternative if you are already on AWS.
Full analysis
Based on ~50 public sources: G2/Gartner reviews, security advisories, Reddit threads, and vendor case studies.
Sources
review
review
- CVE-2022-29464: WSO2 API Manager RCE Vulnerabilitysentinelone.comsecurity
security
- Multiple critical vulnerabilities in WSO2 Identity Serversec-consult.comsecurity
official
news
- WSO2 funding and IPO profileforgeglobal.comnews
review
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.