Read the docs
TI-2025-05206 Aliases CVE-2025-5770GHSA-rc63-xm4j-4f8h

Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server (WSO2): 6.0.0.247, 6.1.0.246, 7.0.0.122 +1WSO2 API Manager (WSO2): 4.2.0.150, 4.3.0.63, 4.4.0.26 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Identity Server6.0.0 to before 6.0.0.247; 6.1.0 to before 6.1.0.246; 7.0.0 to before 7.0.0.122; 7.1.0 to before 7.1.0.296.0.0.247, 6.1.0.246, 7.0.0.122, 7.1.0.29Patch availableCNA
WSO2WSO2 API Manager4.2.0 to before 4.2.0.150; 4.3.0 to before 4.3.0.63; 4.4.0 to before 4.4.0.26; 4.5.0 to before 4.5.0.104.2.0.150, 4.3.0.63, 4.4.0.26, 4.5.0.10Patch availableCNA
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.114.5.0.11Patch availableCNA
  • WSO2 Identity Server VendorWSO2 Affected 6.0.0 to before 6.0.0.247; 6.1.0 to before 6.1.0.246; 7.0.0 to before 7.0.0.122; 7.1.0 to before 7.1.0.29 Fixed in 6.0.0.247, 6.1.0.246, 7.0.0.122, 7.1.0.29 Patch available CNA
  • WSO2 API Manager VendorWSO2 Affected 4.2.0 to before 4.2.0.150; 4.3.0 to before 4.3.0.63; 4.4.0 to before 4.4.0.26; 4.5.0 to before 4.5.0.10 Fixed in 4.2.0.150, 4.3.0.63, 4.4.0.26, 4.5.0.10 Patch available CNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.11 Fixed in 4.5.0.11 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*4.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*4.3.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*4.4.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*4.5.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*6.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*6.1.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*7.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*7.1.0VulnerableWSO2
  • cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 6.0.0.247, 6.1.0.246, 7.0.0.122, 7.1.0.29
  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 4.2.0.150, 4.3.0.63, 4.4.0.26, 4.5.0.10
  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5770
  2. 2026-10-03 Alias added: GHSA-rc63-xm4j-4f8h

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences