Cross-Site Scripting Vulnerability in WSO2 Authentication Endpoint
CVE-2026-11854

6.1MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Identity Server
Vendor
CVE Published:
28 October 2026

What is CVE-2026-11854?

The authentication endpoint of WSO2 Identity Server is susceptible to Cross-Site Scripting (XSS) due to improper handling of error messages. When an error occurs, the system generates a message that reflects data directly from the user's request without adequate sanitization or encoding. This vulnerability enables attackers to craft malicious scripts that may execute in the context of the victim’s browser, allowing various exploitations such as redirection to harmful sites or manipulation of the web interface. Importantly, while session-related cookies have the httpOnly flag enabled, preventing certain types of session hijacking, other risks persist, necessitating immediate attention and appropriate mitigation.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.66

WSO2 API Control Plane 4.6.0 < 4.6.0.30

WSO2 API Control Plane 4.7.0 < 4.7.0.1

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.