Input Encoding Flaw in WSO2 Authentication Process

CVE-2025-5769

What is CVE-2025-5769?

The vulnerability stems from the WSO2 Identity Server's failure to properly encode user-supplied input during the authentication process. This weakness permits an attacker to inject malicious JavaScript code, which can be executed in the context of the user's browser. Consequently, the attacker may manipulate the displayed content, redirect users to harmful websites, or extract sensitive information from the browser. Although this vulnerability does not allow session hijacking thanks to the httpOnly flag applied on certain cookies, it still poses significant risks to user integrity and security.

References