JavaScript Injection Vulnerability in WSO2 Identity Server
CVE-2024-5139

6.1MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Api Manager
Wso2 Open Banking Am
Vendor
CVE Published:
21 October 2026

What is CVE-2024-5139?

A vulnerability in the WSO2 Identity Server's Authentication Endpoint allows for the injection of malicious JavaScript payloads via insufficient input encoding. Attackers can exploit this flaw by submitting crafted data, leading to potential browser redirection to malicious sites, alteration of the web interface, or unauthorized extraction of sensitive browser information. While the risk is notable, the presence of the httpOnly flag on session cookies mitigates the possibility of session hijacking.

Affected Version(s)

WSO2 API Manager 3.1.0 < 3.1.0.286

WSO2 API Manager 3.2.0 < 3.2.0.376

WSO2 API Manager 3.2.1 < 3.2.1.10

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory
https://github.com/wso2/carbon-identity-framework/pull/5740
patch
https://github.com/wso2/carbon-identity-framework/pull/5741
patch

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.