CVE-2025-6024
Published: Apr 16, 2026
Modified: Apr 16, 2026
CVSS v3.1
6.1
Description
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
| Vendor | Product | Versions |
|---|---|---|
WSO2 | WSO2 API Manager | unknown 0 - < 3.1.0affected 3.1.0 - < 3.1.0.351affected 3.2.0 - < 3.2.0.455affected 3.2.1 - < 3.2.1.74affected 4.0.0 - < 4.0.0.375+1 more versions |
WSO2 | WSO2 Identity Server | unknown 0 - < 5.10.0affected 5.10.0 - < 5.10.0.360affected 5.11.0 - < 5.11.0.405 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now