The WSO2 Webhook API accepts user‑supplied values for HTTP request headers without sufficient validation, allowing those values to be injected into the response. This defect lets an attacker set or overwrite arbitrary response headers, potentially manipulating browser caching, tampering with security‑related headers, or exposing sensitive data such as cookie contents, which could enable session hijacking or other malicious activities. The weakness is classified as CWE‑74, indicating unsanitized header injection.

WSO2 products such as API Manager, API Control Plane, Carbon API Gateway, Carbon API Management Implementation, Traffic Manager, and Universal Gateway are affected. No specific product versions are listed; users should check the WSO2 security advisory for the latest patch release.

The CVSS score of 5.3 places this vulnerability in the moderate range. The EPSS score of less than 1 % indicates a very low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can trigger the flaw by sending a crafted request to the Webhook API. No confirmed exploitation is reported yet, but the impact on session integrity and header control warrants timely remediation.