CVE-2025-6024
Cross-Site Scripting in Authentication Endpoint Enables Browser Exploits
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_manager | 3.1.0 |
| wso2 | api_manager | 4.0.0 |
| wso2 | api_manager | 3.2.0 |
| wso2 | api_manager | 3.2.1 |
| wso2 | api_manager | 4.1.0 |
| wso2 | identity_server | 5.11.0 |
| wso2 | identity_server | 5.10.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the authentication endpoint does not encode user-supplied input before displaying it on the web page. This allows an attacker to inject malicious scripts into the page.
When exploited, the attacker can cause the user's browser to execute these malicious scripts, which can lead to redirection to malicious websites, manipulation of the web page's user interface, or unauthorized retrieval of information from the browser.
However, session hijacking is prevented because session-related cookies are protected by the httpOnly flag.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into the authentication page you use.
- Your browser could be redirected to malicious websites without your consent.
- The attacker could manipulate the user interface of the web page, potentially misleading you or causing unintended actions.
- Sensitive information accessible through your browser could be retrieved by the attacker.
Note that session hijacking is not possible due to protections on session cookies.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows for script injection via the authentication endpoint, which can lead to malicious redirection, manipulation of the web page interface, or unauthorized retrieval of information from the user's browser.
Such exploitation could potentially lead to unauthorized access to personal or sensitive data, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding user data and preventing unauthorized data access or disclosure.
However, session hijacking is mitigated by the httpOnly flag on session cookies, reducing some risk.
Overall, this vulnerability could pose a risk to compliance by enabling data leakage or manipulation through cross-site scripting attacks.