CVE-2026-11854
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
| CWE | CWE-79 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Oct 28, 2026 |
| Last Updated | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new medium vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 API Manager
3.2.0 < 3.2.0.480 3.2.1 < 3.2.1.99 4.1.0 < 4.1.0.265 4.2.0 < 4.2.0.205 4.3.0 < 4.3.0.117 4.4.0 < 4.4.0.80 4.5.0 < 4.5.0.65 4.6.0 < 4.6.0.29 4.7.0 < 4.7.0.1
WSO2 / WSO2 API Control Plane
4.5.0 < 4.5.0.66 4.6.0 < 4.6.0.30 4.7.0 < 4.7.0.1
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.399 5.11.0 < 5.11.0.446 6.0.0 < 6.0.0.272 6.1.0 < 6.1.0.274 7.0.0 < 7.0.0.155 7.1.0 < 7.1.0.65 7.2.0 < 7.2.0.26