CVE-2025-6024
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.
Published Apr 16, 2026 · updated Oct 14, 2026 · wso2 api manager
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 16, 2026 · NIST NVD
Detected
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browse
Oct 14, 2026 · NIST NVD
Updated
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browse
Affected
- cpe wso2/api manager3.1.0
- cpe wso2/api manager3.2.0
- cpe wso2/api manager3.2.1
- cpe wso2/api manager4.0.0
- cpe wso2/api manager4.1.0
- cpe wso2/identity server5.10.0
- cpe wso2/identity server5.11.0
Sources
- CVE.orgVulnerability recordCVE-2025-6024
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-6024
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-6024
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirecte
nvd.nist.gov