6.1Medium
CVE-2025-5770Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| wso2 | api control plane | 4.5.0 | |
| wso2 | api manager | 4.2.0 | |
| wso2 | identity server | 6.0.0 | |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.11 | |
| WSO2 | WSO2 API Manager | 4.2.0 – < 4.2.0.150, 4.3.0 – < 4.3.0.63, 4.4.0 – < 4.4.0.26, 4.5.0 – < 4.5.0.10 | |
| WSO2 | WSO2 Identity Server | 6.0.0 – < 6.0.0.247, 6.1.0 – < 6.1.0.246, 7.0.0 – < 7.0.0.122, 7.1.0 – < 7.1.0.29 |
References and patches
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4270/ vendor-advisoryVendor Advisory
CPE matches (NVD) (9)
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*