CVE-2026-2445
Received Received - Intake

Reflected Cross-Site Scripting in Product

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WSO2 LLC

Description
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-2445
EUVD
EUVD-2026-45898

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
wso2 api_control_plane 4.6.0
wso2 api_control_plane 4.5.0
wso2 api_manager 4.6.0
wso2 api_manager 4.5.0
wso2 api_manager 4.4.0
wso2 api_manager 4.3.0
wso2 api_manager 4.2.0
wso2 identity_server 7.2.0
wso2 identity_server 7.1.0
wso2 identity_server 7.0.0
wso2 identity_server 6.1.0
wso2 identity_server 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability where the affected WSO2 products accept user input in URL parameters without proper sanitization or encoding. This allows attackers to inject malicious JavaScript payloads that execute in the user's browser when the URL is accessed.

Detection Guidance

To detect this reflected XSS vulnerability, monitor web traffic for suspicious URL parameters containing JavaScript payloads. Check logs for requests with unusual characters like <script> tags or event handlers (e.g., onerror=). Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests for unsanitized input.

Impact Analysis

An attacker could use this to redirect your browser to a malicious site, modify the webpage's appearance or behavior, or steal sensitive information from your browser. However, session hijacking is limited because session cookies are protected by the httpOnly flag.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling attackers to retrieve sensitive information from the browser or modify the user interface of webpages, which may lead to unauthorized data access or disclosure. The risk is partially mitigated by httpOnly cookies, but the potential for information retrieval and UI manipulation remains.

Mitigation Strategies

Apply the latest patches from WSO2 for affected products (API Control Plane 4.6.0/4.5.0, API Manager 4.6.0-4.2.0, Identity Server 7.2.0-6.0.0). For community users, apply the GitHub fix or upgrade to the latest unaffected version. Ensure input validation and output encoding are enforced in all URL parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart