Reflected Cross-Site Scripting Vulnerability in WSO2 Authentication Endpoint

CVE-2025-10503

What is CVE-2025-10503?

The vulnerability in the WSO2 authentication endpoint arises from improper validation of user-supplied input, which permits the injection of malicious JavaScript payloads. This could allow attackers to alter the user interface, redirect users to malicious sites, or extract sensitive information from the user's browser. Although the session cookies are secured with the httpOnly flag, preventing session hijacking, users remain vulnerable to other exploits leveraging this XSS flaw.

References