CVE-2025-8154
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to…
Published May 11, 2026 · updated Oct 14, 2026 · wso2 api control plane
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · NIST NVD
Detected
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, a
Oct 14, 2026 · NIST NVD
Updated
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, a
Affected
- cpe wso2/api control planeversion unspecified
- cpe wso2/api managerversion unspecified
- cpe wso2/traffic managerversion unspecified
- cpe wso2/universal gatewayversion unspecified
Sources
- CVE.orgCVE-2025-8154
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-8154
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2025-8154
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite ar
nvd.nist.gov