The authentication endpoint in WSO2 products does not encode user‑supplied input before rendering it, creating a cross‑site scripting vulnerability. An attacker can embed malicious JavaScript into the endpoint, which the victim’s browser will execute. The script can redirect the user to a malicious site, alter the page’s user interface, or exfiltrate data stored in the browser. Session hijacking is not feasible because session cookies are protected with the httpOnly flag.

The vulnerability affects WSO2 API Manager and WSO2 Identity Server. Specific product versions are not listed in the advisory, so all recent releases should be verified for a fix.

This issue carries a moderate CVSS score of 6.1, with an EPSS score of 0.0003 and has not yet been listed in the CISA KEV catalog. Because the flaw resides in a public authentication endpoint, exploitation is possible over the internet when a user visits or interacts with the vulnerable page. The attack required the victim’s browser to load the injected script, implying a user‑interaction component, but developers or attackers can craft malicious links to entice users. The absence of session cookie compromise limits the threat to client‑side damage and data theft rather than full account takeover.