CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter

CVE-2025-8591 · Severity: medium · CVSS 6.1 · Published 2026-07-06

WSO2 Identity Server and API Manager, which are used to manage digital identities and application interfaces, are vulnerable to a security flaw where malicious scripts can be injected into web pages. An attacker could use this to redirect users to fraudulent websites or alter the appearance of the application to trick users. While the risk of full account takeover is reduced because session cookies are specially protected, users could still be exposed to phishing or data theft within their browser session.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server, Wso2 Open Banking AM, Wso2 Open Banking IAM, Wso2 Traffic Manager. Vendors: Wso2.

Quick answers

Is CVE-2025-8591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-8591 being exploited in the wild.
How severe is CVE-2025-8591?
Medium severity, with a CVSS score of 6.1, published 6 July 2026.
Which products and versions are affected?
Wso2 API Control Plane 4.6.0, 4.5.0; Wso2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0; Wso2 Identity Server 7.1.0, 7.0.0, 6.0.0, 5.10.0; Wso2 Open Banking AM 2.0.0; and 2 more.
Is there a fix for CVE-2025-8591?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-8591 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-8591?
Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products, including Identity Server and API Manager, due to improper neutralization of user-supplied input in URL parameters (CWE-79). An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser session. This can lead to UI redressing, unauthorized redirection, or information disclosure. The impact is partially mitigated by the use of the 'httpOnly' flag on session cookies, which prevents the script from accessing session tokens. Patches are available via WSO2 updates and public GitHub pull requests for community users.

Affected products

  • WSO2 Identity Server 7.1.0, 7.0.0, 6.0.0, 5.10.0
  • WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0
  • WSO2 API Control Plane 4.6.0, 4.5.0
  • WSO2 Traffic Manager 4.6.0, 4.5.0
  • WSO2 Open Banking AM 2.0.0
  • WSO2 Open Banking IAM 2.0.0

Timeline

  • 2026-05-03: advisory: Original WSO2 advisory published
  • 2026-07-06: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.