Executive brief
WSO2 Identity Server and API Manager, which are used to manage digital identities and application interfaces, are vulnerable to a security flaw where malicious scripts can be injected into web pages. An attacker could use this to redirect users to fraudulent websites or alter the appearance of the application to trick users. While the risk of full account takeover is reduced because session cookies are specially protected, users could still be exposed to phishing or data theft within their browser session.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products, including Identity Server and API Manager, due to improper neutralization of user-supplied input in URL parameters (CWE-79). An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser session. This can lead to UI redressing, unauthorized redirection, or information disclosure. The impact is partially mitigated by the use of the 'httpOnly' flag on session cookies, which prevents the script from accessing session tokens. Patches are available via WSO2 updates and public GitHub pull requests for community users.
Affected products
- WSO2 Identity Server 7.1.0, 7.0.0, 6.0.0, 5.10.0
- WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0
- WSO2 API Control Plane 4.6.0, 4.5.0
- WSO2 Traffic Manager 4.6.0, 4.5.0
- WSO2 Open Banking AM 2.0.0
- WSO2 Open Banking IAM 2.0.0
Timeline
- 2026-05-03: advisory: Original WSO2 advisory published
- 2026-07-06: disclosed: CVE published to NVD