HTTP Response Header Injection Vulnerability in WSO2 Product

CVE-2025-8154

What is CVE-2025-8154?

A vulnerability exists in the Webhook API invocations of WSO2 API Management that permits the injection of unvalidated user-supplied input into HTTP request headers. This deficiency allows malicious actors to manipulate HTTP responses by injecting or overwriting arbitrary headers. The repercussions include browser caching manipulation, alteration of critical security headers, and exposure of sensitive information, such as cookie values, which can facilitate session hijacking and other attacks on the application.

References