The authentication endpoint of several WSO2 products accepts user‑supplied input without adequate encoding, allowing an attacker to embed malicious JavaScript. When the request is processed, the payload is rendered in the browser, enabling the attacker to modify the page’s user interface, redirect the user to a malicious site, or extract sensitive information from the browser’s context. Because the session cookies are marked httpOnly, an attacker cannot hijack the user’s session state, but the XSS can still be abused for phishing, credential stealing, or side‑channel attacks.

Affected vendors include WSO2, with impacted products such as WSO2 API Manager, WSO2 Carbon User Management UI, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. The vulnerability is present in all versions of these components released prior to the patch outlined in the WSO2 security advisory.

The CVSS score of 6.1 indicates a medium severity risk, but the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The most plausible attack vector involves an attacker preparing a crafted authentication request that includes malicious JavaScript and sending it to the endpoint via HTTP or HTTPS. Although session hijacking is prevented by the httpOnly flag, successful exploitation can still provide social‑engineering opportunities, page tampering, or web‑based data theft. The overall risk is moderate, with the potential impact depending on the sensitivity of the data the authenticated user can access.