The vulnerability resides in the authentication endpoint of WSO2 Identity Server, which accepts user input without enforcing validation constraints or output encoding, allowing attackers to inject malicious JavaScript payloads for reflected cross‑site scripting. The impact can include redirecting users to malicious sites, modifying page content, or exfiltrating data from the browser, but session hijacking is mitigated by httpOnly cookies. The likely attack vector is via crafted HTTP requests to the authentication endpoint, though the description does not explicitly state the network scope.

WSO2 Identity Server is affected; no specific version information is provided by the CNA, so all released releases may be vulnerable until the patch is applied.

With a CVSS score of 6.1, the vulnerability is considered medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation. The attack vector is remote, relying on the ability to submit crafted input to the authentication endpoint. The lack of session cookie hijacking reduces the overall damage potential, but the XSS payload can still manipulate user interactions.