CVE-2024-5139
Received
Received - Intake
Reflected XSS in Authentication Endpoint
Vulnerability report for CVE-2024-5139, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: WSO2 LLC
Description
Description
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| WSO2 | WSO2 | Enterprise Integrator 6.6.0 |
| WSO2 | WSO2 | Identity Server 5.10.0 |
| WSO2 | WSO2 | Identity Server 6.0.0 |
| WSO2 | WSO2 | Identity Server 6.1.0 |
| WSO2 | WSO2 | Identity Server 7.0.0 |
| WSO2 | WSO2 | API Manager 3.1.0 |
| WSO2 | WSO2 | API Manager 3.2.0 |
| WSO2 | WSO2 | API Manager 3.2.1 |
| WSO2 | WSO2 | API Manager 4.0.0 |
| WSO2 | WSO2 | API Manager 4.1.0 |
| WSO2 | WSO2 | API Manager 4.2.0 |
| WSO2 | WSO2 | API Manager 4.3.0 |
| WSO2 | WSO2 | Open Banking AM 2.0.0 |
| WSO2 | WSO2 | Identity Server as Key Manager 5.10.0 |
| WSO2 | WSO2 | Open Banking IAM 2.0.0 |
| WSO2 | WSO2 | Carbon User Management UI 5.14.127 |
| WSO2 | WSO2 | Carbon User Management UI 5.17.5 |
| WSO2 | WSO2 | Carbon User Management UI 5.17.118 |
| WSO2 | WSO2 | Carbon User Management UI 5.18.187 |
| WSO2 | WSO2 | Carbon User Management UI 5.18.248 |
| WSO2 | WSO2 | Carbon User Management UI 5.23.8 |
| WSO2 | WSO2 | Carbon User Management UI 5.24.8 |
| WSO2 | WSO2 | Carbon User Management UI 5.25.92 |
| WSO2 | WSO2 | Carbon User Management UI 5.25.705 |
| WSO2 | WSO2 | Carbon User Management UI 7.0.78 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
