The vulnerability resides in the callback URL parameter of WSO2 API Manager, which does not validate user‑supplied input, enabling an attacker to supply arbitrary URLs. This flaw allows an open redirection to attacker‑controlled sites, which can be leveraged for phishing attacks to steal credentials or further compromise users.

WSO2 API Manager is the affected product. All releases that expose the callback URL feature are potentially vulnerable until a vendor‑provided fix is applied; specific version information is not supplied in the advisory.

The CVSS score of 5.4 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker crafting a request to the callback URL endpoint, exploiting the lack of input validation to redirect users to malicious sites. No authentication or privileged conditions are explicitly required, so the exploit can affect any user with access to the API Manager’s callback functionality.