CVE-2025-5769Medium· 6.1▾ SunlitThe authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.
By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.
api_control_plane >= 4.5.0 < 4.5.0.11api_manager >= 3.2.0 < 3.2.0.430api_manager >= 3.2.1 < 3.2.1.50api_manager >= 4.1.0 < 4.1.0.212api_manager >= 4.2.0 < 4.2.0.150api_manager >= 4.3.0 < 4.3.0.63api_manager >= 4.4.0 < 4.4.0.26api_manager >= 4.5.0 < 4.5.0.10identity_server >= 5.10.0 < 5.10.0.359identity_server >= 5.11.0 < 5.11.0.404identity_server >= 6.0.0 < 6.0.0.237identity_server >= 6.1.0 < 6.1.0.234identity_server >= 7.0.0 < 7.0.0.107identity_server >= 7.1.0 < 7.1.0.12Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4217/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4103Medium· 6.4Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization
CVE-2024-7075Medium· 4.6Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
CVE-2025-12544Medium· 4.8Stored Cross-Site Scripting in Multiple WSO2 Products
CVE-2026-11854Medium· 6.1Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
CVE-2024-5139Medium· 6.1Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVE-2025-6623Medium· 4.3Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection