The authentication endpoint fails to encode user‐supplied input before rendering it in the response, creating a reflected cross‑site scripting flaw. Attackers can inject malicious JavaScript that will execute in the victim’s browser, enabling the attacker to redirect the user to a malicious site, alter the page’s content, or exfiltrate data from the browser. Session hijacking is mitigated by the httpOnly flag on sensitive cookies, so the primary risk lies in client‑side compromise and data leakage rather than immediate account takeover.

WSO2 API Control Plane, WSO2 API Manager, and WSO2 Identity Server are affected. No specific version range is listed, so any deployments of these products are potentially vulnerable unless the referenced fix has been applied.

The CVSS score of 6.1 categorises the flaw as a moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The likely attack vector involves a malicious request to the authentication endpoint that is rendered by the victim’s browser; the attacker must rely on user interaction (visiting a crafted link or page) to trigger the XSS payload.