# CVE-2024-5139: WSO2 Carbon Identity Framework reflected XSS in authentication endpoint

Source: https://junglewise.ai/threats/cve-2024-5139-the-authentication-endpoint-accepts-user-supplied-input-without  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2024-5139 · Severity: medium · CVSS 6.1 · Published 2026-10-21

WSO2 Carbon Identity Framework is an identity and access management platform used by organizations to manage user authentication and authorization. A reflected cross-site scripting (XSS) vulnerability in the authentication endpoint allows attackers to inject malicious JavaScript that can redirect users to phishing sites, steal sensitive information displayed on the page, or manipulate the login interface. While session cookies are protected with the httpOnly flag preventing session theft, the vulnerability still poses a significant phishing and data exfiltration risk.

Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2024-5139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-5139 being exploited in the wild.

**How severe is CVE-2024-5139?** Medium severity, with a CVSS score of 6.1, published 21 October 2026.

**Which products and versions are affected?** WSO2 Carbon Identity Framework.

**Is there a fix for CVE-2024-5139?** Yes: fixed in Carbon Identity Framework versions patched in master branch (post-August 6, 2024) and 5.25.x branch (post-June 12, 2024). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-5139 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-5139?** Check whether you run Wso2 Carbon Identity Framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Carbon Identity Framework versions patched in master branch (post-August 6, 2024) and 5.25.x branch (post-June 12, 2024)

## Technical details

The authentication endpoint fails to properly encode user-supplied input before rendering it in JSP pages, allowing reflected XSS injection via a roleName parameter or similar input vector. An attacker can craft a malicious URL with JavaScript payloads that execute in the victim's browser when visiting the authentication page. The attack requires user interaction (clicking a link) but no authentication, and is mitigated only by the httpOnly flag protecting session cookies; sensitive data still accessible to JavaScript remains at risk.

## Affected products

- WSO2 Carbon Identity Framework

## Timeline

- 2026-10-21: disclosed
- 2024-08-06: patched: Fix merged to master branch
- 2024-06-12: patched: Fix merged to 5.25.x branch

## References

- [https://github.com/wso2/carbon-identity-framework/pull/5740](https://github.com/wso2/carbon-identity-framework/pull/5740)
- [https://github.com/wso2/carbon-identity-framework/pull/5741](https://github.com/wso2/carbon-identity-framework/pull/5741)