WSO2 CVE-2026-2445

The attacker must deliver a crafted URL containing the XSS payload to a victim who actively clicks it while their browser is able to reach the WSO2 application (UI:R is a hard prerequisite). The WSO2 application must be reachable over a network from the victim's browser - no special non-default configuration is required beyond the application being accessible. Exploitation is limited by: mandatory victim interaction (no drive-by without click), the httpOnly flag which prevents JavaScript from reading session cookies (reducing the most severe session-hijacking outcome), and the requirement that the victim have a browser session or be socially engineered into visiting the link. Authentication to the WSO2 application by the victim is NOT required by the attacker to inject the payload, but the practical value of the attack increases if the victim is already authenticated to the application.

The CVSS base score of 6.1 (Medium) accurately reflects real-world risk for this reflected XSS. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-reachable exploitation with no authentication barrier, but mandatory user interaction (UI:R) is a genuine limiting factor - the attacker must deliver the crafted URL to a victim who then clicks it. EPSS data was not provided, so exploitation probability cannot be quantified. There is no CISA KEV listing, and no public POC has been identified, suggesting this is not actively exploited at scale. The httpOnly cookie protection noted in the description meaningfully reduces the impact by preventing trivial session token theft, which is the most common high-value outcome of reflected XSS. Residual risks include phishing via redirect, credential harvesting through fake login overlays injected into the legitimate page, and exfiltration of non-cookie data such as CSRF tokens or page content. Net assessment: lower-urgency patching for most environments, but should be prioritized if the affected WSO2 component is user-facing and externally accessible.

An attacker identifies the vulnerable URL parameter in the WSO2 web interface, constructs a link embedding a JavaScript payload (e.g., a redirect to a cloned login page or a script that exfiltrates the page's CSRF token), then delivers this link to a targeted WSO2 user via phishing email or message. When the victim authenticates to WSO2 and clicks the link, their browser executes the injected script under the application's origin. No public POC has been identified, but reflected XSS exploitation at this complexity level is well within reach of script-level attackers given the AV:N/AC:L/PR:N conditions.