The authentication endpoint does not enforce proper validation of user input and echoes it back to the client. This flaw allows an attacker to inject malicious scripts that are executed within the victim’s browser, enabling UI alteration, redirection to malicious sites, or extraction of sensitive data from the browser. The vulnerability is a classic reflected XSS flaw (CWE‑79). The impact is confined to confidentiality and integrity of data presented in the browser; session cookies are guarded with httpOnly, so session hijacking is not possible.

WSO2 API Manager. No specific product version details are supplied in the advisory, so all installations of the product are potentially susceptible until a patch is applied.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. The likely attack vector is remote via the exposed authentication endpoint, where an attacker supplies malicious input in the request parameters. Once the payload reaches the client, it runs with the privileges of the authenticated user in that session.