6.1
MediumCVSS 3.1 · from WSO2
CVE-2026-11854
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
WSO2 API Manager · Cross-site scripting · CWE-79AffectedWSO2 API Manager, WSO2 API Control Plane, WSO2 Identity Server
FixUpdate to 3.2.0.480, 3.2.1.99, 4.1.0.265, 4.2.0.205 or newer
PublishedOct 28, 19:21 · WSO2
ScoredOct 28 · 6.1 · WSO2
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
From WSO2
Affected and fixed versions
ProductAffectedFixed inWSO2 API Manager3.2.0 – before 3.2.0.4803.2.0.480WSO2 API Manager3.2.1 – before 3.2.1.993.2.1.99WSO2 API Manager4.1.0 – before 4.1.0.2654.1.0.265WSO2 API Manager4.2.0 – before 4.2.0.2054.2.0.205WSO2 API Manager4.3.0 – before 4.3.0.1174.3.0.117WSO2 API Manager4.4.0 – before 4.4.0.804.4.0.80WSO2 API Manager4.5.0 – before 4.5.0.654.5.0.65WSO2 API Manager4.6.0 – before 4.6.0.294.6.0.29WSO2 API Manager4.7.0 – before 4.7.0.14.7.0.1WSO2 API Control Plane4.5.0 – before 4.5.0.664.5.0.66WSO2 API Control Plane4.6.0 – before 4.6.0.304.6.0.30WSO2 API Control Plane4.7.0 – before 4.7.0.14.7.0.1WSO2 Identity Server5.10.0 – before 5.10.0.3995.10.0.399WSO2 Identity Server5.11.0 – before 5.11.0.4465.11.0.446WSO2 Identity Server6.0.0 – before 6.0.0.2726.0.0.272WSO2 Identity Server6.1.0 – before 6.1.0.2746.1.0.274WSO2 Identity Server7.0.0 – before 7.0.0.1557.0.0.155WSO2 Identity Server7.1.0 – before 7.1.0.657.1.0.65WSO2 Identity Server7.2.0 – before 7.2.0.267.2.0.26
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known