WSO2 API Manager CVE-2026-11854

Exploitation requires an attacker to deliver a crafted request to the WSO2 authentication endpoint whose reflected input is rendered into the error message without sufficient sanitization or encoding, and critically requires the victim to interact by following the attacker-supplied link (CVSS UI:R) - it is not a server-side silent compromise. No authentication is required to reach the endpoint (PR:N), and default configurations appear affected per the vendor advisory. The key limiting factor explicitly stated by the vendor is that session-related cookies use the httpOnly flag, preventing session hijacking or cookie theft; realistic impact is therefore confined to in-browser actions such as redirection, UI modification, and retrieval of script-accessible information in the WSO2 origin context.

This is a medium-severity reflected cross-site scripting (CWE-79) flaw rather than a top-priority emergency, and the signals are largely consistent on that point. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) indicates a network-reachable, low-complexity, unauthenticated issue (PR:N) that nonetheless requires victim interaction (UI:R), which materially reduces real-world exploitability since an attacker must lure a user into triggering the reflected payload. The scope change (S:C) and Low confidentiality/integrity impacts reflect that code runs in the victim's browser context, not on the server. No EPSS score, no CISA KEV entry, and no public exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of EPSS/KEV data here is a gap, not a signal of safety. The vuln.today decision label is 'this_month', which aligns with a real-but-not-critical fix priority. A notable mitigating detail stated by the vendor is that session cookies carry the httpOnly flag, so session hijacking via this XSS is not possible - this caps the practical impact to UI manipulation, redirection, and limited data retrieval. Overall: a genuine issue worth patching on a normal cycle, not a high-CVSS-but-illusory risk, but also not an emergency given the required user interaction and the httpOnly mitigation.

An attacker crafts a URL targeting the WSO2 authentication endpoint with a malicious script embedded in a parameter that is reflected unsanitized into the error message, then delivers it to a victim via phishing email or a malicious link. When the victim clicks and their browser renders the error page, the injected script executes in the WSO2 origin's context, allowing the attacker to redirect the user, alter the page UI, or read accessible information. No public exploit code was identified in the provided data, and successful exploitation depends on the victim interacting with the attacker-supplied link (UI:R).