The vulnerability lies in the error handling code that does not properly sanitize user‑supplied URL parameters under certain conditions. As a result, attackers can inject arbitrary content into the error messages displayed by the application. This allows the attacker to replace legitimate error prompts with malicious text that can trick users into sharing sensitive information or performing unintended actions, effectively enabling phishing or credential‑stealing social engineering attacks.

The flaw affects WSO2 API Manager, WSO2 Identity Server, and WSO2 Identity Server as Key Manager. No specific version information is provided in the CVE data, so any deployment of these products is potentially impacted until the official fix is applied.

The CVSS score of 4.3 classifies the issue as low severity, and the EPSS score is not available; the vulnerability is also not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via a crafted HTTP request that includes malicious URL parameters. Successful exploitation requires end‑user interaction to view the injected error message, but once displayed, the content can mislead users into divulging credentials or executing harmful actions.