EUVD-2026-45898
GHSA-vcj5-r64m-jr4f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring victim click (UI:R); scope changes to browser context (S:C); httpOnly limits confidentiality to L; no availability impact.
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
2DescriptionCVE.org
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.
An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.
AnalysisAI
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied data from a URL query parameter is reflected directly into the HTTP response without HTML-encoding or JavaScript-context sanitization. Because the CVSS vector shows Scope:Changed (S:C), the vulnerability crosses the security boundary from the web application into the victim's browser execution context. This is a classic server-side reflected XSS pattern, where the payload is not stored but must be delivered to the victim via a crafted link. The reference points to WSO2 advisory WSO2-2026-5059 at security.docs.wso2.com; the specific WSO2 product line affected is not determinable from the provided data without accessing the advisory directly. WSO2 produces enterprise integration middleware including Identity Server, API Manager, and Enterprise Integrator - all of which expose web interfaces over HTTP.
RemediationAI
Consult WSO2 advisory WSO2-2026-5059 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/ for the vendor-released patch and exact fixed version, which are not independently confirmable from the data provided. As a compensating control prior to patching, deploy a Web Application Firewall (WAF) rule to detect and block reflected XSS patterns in URL parameters directed at the affected endpoint - note this may generate false positives on legitimate URL-encoded content and requires tuning. Additionally, if the vulnerable endpoint is not required for external users, restrict access to internal networks or authenticated sessions via network ACLs or reverse proxy rules. Strict Content-Security-Policy (CSP) headers configured to disallow inline scripts would substantially reduce the exploitability of any remaining XSS surface, though this may break functionality if the application relies on inline JavaScript.
More in Api Control Plane
View allAuthenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST AP
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to i
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products du
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the Graal
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded conte
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML par
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAp
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input valida
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper valida
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today