The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.
An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
23 Apr 2026, 15:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/ - Vendor Advisory | |
| CPE | cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* |
|
| First Time |
Wso2 api Manager
Wso2 Wso2 identity Server |
16 Apr 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-16 10:16
Updated : 2026-04-23 15:35
NVD link : CVE-2025-6024
Mitre link : CVE-2025-6024
CVE.ORG link : CVE-2025-6024
JSON object : View
Products Affected
wso2
- identity_server
- api_manager
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')