WSO2 Identity Server CVE-2025-10503

Exploitation requires the target to be running WSO2 Identity Server 7.1.0 prior to build 7.1.0.28, with the authentication (login) endpoint reachable over the network by the attacker. The primary limiting condition is mandatory user interaction (UI:R per CVSS): the victim must click a crafted URL or be redirected through an attacker-controlled page that forwards them to the vulnerable endpoint. No authentication is required from the attacker's side. Exploitation is further limited by the httpOnly flag on session-related cookies, which prevents JavaScript from accessing session tokens, ruling out session hijacking as an outcome. The attack surface is confined to the pre-authentication login flow, so post-login or API endpoints are not confirmed affected. Non-default configurations are not required - any default deployment of the affected version with a network-accessible login page is vulnerable to this attack if a user can be induced to click a crafted link.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a low-complexity, unauthenticated network attack requiring one user interaction - the victim clicking a crafted link - with a changed scope representing the browser context crossing domain trust. These metrics are consistent with reflected XSS and appear accurate. However, real-world risk is further bounded by several factors: EPSS of 0.03% at the 9th percentile indicates extremely low observed exploitation probability relative to all known CVEs; SSVC rates exploitation as 'none' and the attack as 'not automatable' (consistent with UI:R), with only partial technical impact. The httpOnly cookie protection, explicitly stated in the CVE description, eliminates the most damaging XSS outcome - session token theft - reducing the confidentiality impact to browser-accessible non-session data only. The CVSS score is reasonable but not a call to emergency action; the convergence of low EPSS, no KEV listing, no confirmed POC, and non-automatable SSVC classification positions this as a patch-on-normal-cycle issue for most organizations, with elevated priority for identity provider deployments where phishing risk to admin users is higher.

An attacker identifies an organization running WSO2 Identity Server 7.1.0 prior to 7.1.0.28 with a publicly accessible login portal. The attacker crafts a URL targeting the authentication endpoint with a malicious JavaScript payload embedded in a query parameter - for example, a fake login overlay that exfiltrates entered credentials to an attacker-controlled server - and delivers this link to a target user via a phishing email impersonating an IT helpdesk notification. When the victim clicks the link, the identity server reflects the payload directly into the login page HTML, executing the attacker's script in the victim's browser under the identity server's domain. No confirmed public POC is available at time of analysis.