The vulnerability arises when an authentication endpoint returns an error message that reflects unsanitized user input directly into the response body. This design flaw allows a malicious actor to embed and execute arbitrary JavaScript in the victim’s browser, enabling actions such as redirecting to malicious sites, UI manipulation, or data theft. The flaw is a classic reflected XSS and is confirmed by the presence of CWE‑79.

WSO2 products affected by this flaw include the API Control Plane, API Manager, and Identity Server. No specific version range is supplied in the advisory, so any instance of these products remains potentially vulnerable until a patch or higher release is applied.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score is not available, making exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a documented widely‑used exploit. The attack vector is inferred to be remote, delivered via crafted authentication requests sent over the network, and the impact is confined to the victim’s browser session, as session hijacking is mitigated by the httpOnly flag on session cookies.