Vulnerability · Published Nov 5, 2025 · Assigned by WSO2
CVE-2025-5770Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Medium 6.1
In plain English
A medium-severity cross-site scripting in WSO2 API Control Plane from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Identity Server | 6.0.0 – before 6.0.0.2476.1.0 – before 6.1.0.2467.0.0 – before 7.0.0.1227.1.0 – before 7.1.0.29 |
| WSO2 | WSO2 API Manager | 4.2.0 – before 4.2.0.1504.3.0 – before 4.3.0.634.4.0 – before 4.4.0.264.5.0 – before 4.5.0.10 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – before 4.5.0.11 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N