The flaw is caused by the application accepting user‑supplied data through a URL parameter and reflecting it back to the browser without applying sufficient output encoding. This defect allows an attacker to inject malicious script that executes in the victim’s browser, enabling actions such as redirecting the user to a malicious site, altering the page’s user interface, or reading and transmitting data from the browser. The use of httpOnly limits the risk of session hijacking, so the primary impact resides in client‑side manipulation and potential data leakage rather than server‑side compromise.

All variants of WSO2 WSO2 API Manager, WSO2 Identity Server (including Key Manager), WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 and WSO2 Universal Gateway are affected. No specific version range is listed, so any released version of these products prior to the advisory’s fix is considered vulnerable.

The CVSS score of 6.1 of less than 1% and the fact that the vulnerability is not listed in CISA’s KEV catalog suggest a low likelihood of widespread exploitation. Based on the description, it is inferred that the attacker can exploit the flaw by crafting a victim to click it. This attack vector would result in client‑side compromise and data leakage, without enabling remote code execution on the server.