Description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks.
Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Metrics
CVSS 3.1 6.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Identity Server | >= 6.0.0, < 6.0.0.247; >= 6.1.0, < 6.1.0.246; >= 7.0.0, < 7.0.0.122; >= 7.1.0, < 7.1.0.29 |
| WSO2 | WSO2 API Manager | >= 4.2.0, < 4.2.0.150; >= 4.3.0, < 4.3.0.63; >= 4.4.0, < 4.4.0.26; >= 4.5.0, < 4.5.0.10 |
| WSO2 | WSO2 API Control Plane | >= 4.5.0, < 4.5.0.11 |
References
Timeline
- Published
- Nov 5, 2025
- Last modified
- Oct 18, 2026
- NVD status
- Analyzed