EUVD-2025-209586Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requires victim to click crafted URL (UI:R); changed scope (S:C) reflects browser executing script under application domain; httpOnly cookies cap confidentiality to L, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting.
An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.
AnalysisAI
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers to inject arbitrary JavaScript into victims' browsers by luring them to click a crafted URL. Versions 7.1.0 prior to 7.1.0.28 are confirmed affected; a vendor patch is available. While the attack can enable browser redirection, UI manipulation, and theft of browser-accessible data, the explicit use of the httpOnly flag on session cookies prevents session hijacking, partially constraining real-world impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.03%.
Technical ContextAI
WSO2 Identity Server is an enterprise identity and access management (IAM) platform handling authentication, authorization, and identity federation. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically at the authentication endpoint, where user-supplied input is reflected into HTTP responses without proper validation or output encoding. This allows attacker-controlled strings to be interpreted as executable JavaScript by the victim's browser. The affected CPE is cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*, with the EUVD (EUVD-2025-209586) confirming the vulnerable range as WSO2 Identity Server 7.1.0 prior to build 7.1.0.28. Because the flaw resides in the pre-authentication login flow, it is reachable without any credential, making it broadly accessible to external network attackers who can craft a malicious URL.
RemediationAI
Upgrade WSO2 Identity Server to version 7.1.0.28 or later, which resolves this vulnerability per the vendor advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4577/. If immediate patching is not feasible, restrict access to the authentication endpoint to trusted IP ranges or internal networks via network access controls or a reverse proxy, significantly reducing the attacker's ability to deliver crafted URLs to internal users. Deploying a Web Application Firewall rule to detect and block reflected XSS patterns on login endpoint responses is an additional compensating control, though WAF rules carry a risk of false positives on legitimate authentication parameters and should be validated in a staging environment before production deployment. User security awareness training to recognize and avoid clicking unsolicited links to the identity server login page provides a behavioral mitigation with no technical side effects.
More in Wso2 Identity Server
View allAuthentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated att
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Modul
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentica
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are n
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segrega
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today