Description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Problem types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Product status
Any version before 6.0.0
6.0.0 (custom) before 6.0.0.247
6.1.0 (custom) before 6.1.0.246
7.0.0 (custom) before 7.0.0.122
7.1.0 (custom) before 7.1.0.29
Any version before 4.2.0
4.2.0 (custom) before 4.2.0.150
4.3.0 (custom) before 4.3.0.63
4.4.0 (custom) before 4.4.0.26
4.5.0 (custom) before 4.5.0.10
4.5.0 (custom) before 4.5.0.11
Credits
crnković
References
security.docs.wso2.com/...ty-advisories/2025/WSO2-2025-4270/
