Reflected Cross-Site Scripting Vulnerability in WSO2 Products

CVE-2025-5770

What is CVE-2025-5770?

Multiple products from WSO2 are affected by a reflected cross-site scripting vulnerability stemming from insufficient output encoding in their authentication endpoints. This issue allows attackers to inject malicious JavaScript payloads, which are returned in the response to the victims. By exploiting this vulnerability, attackers can redirect users to malicious sites, manipulate the user interface, or gain unauthorized access to data through the victim’s browser. Although the risk of session hijacking is mitigated due to session-related cookies being protected with the httpOnly flag, the potential for phishing and other client-side attacks remains a significant concern.

References