All vulnerabilities
CVE-2024-5139

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

WSO2 WSO2 Enterprise Integrator
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.6.0.204Also 5.10.0.310, 6.0.0.212 and 22 moreCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 25 fixed versions
  • 3.2.0.376WSO2 API ManagerCVE List
  • 3.2.1.10WSO2 API ManagerCVE List
  • 4.0.0.299WSO2 API ManagerCVE List
  • 4.1.0.159WSO2 API ManagerCVE List
  • 4.2.0.91WSO2 API ManagerCVE List
  • 4.3.0.6WSO2 API ManagerCVE List
  • 2.0.0.336WSO2 Open Banking AMCVE List
  • 5.10.0.306WSO2 Identity Server as Key ManagerCVE List
  • 2.0.0.357WSO2 Open Banking IAMCVE List
  • 5.14.127.6WSO2 Carbon User Management UICVE List
  • 5.17.5.273WSO2 Carbon User Management UICVE List
  • 5.17.118.3WSO2 Carbon User Management UICVE List
  • 5.18.187.260WSO2 Carbon User Management UICVE List
  • 5.18.248.12WSO2 Carbon User Management UICVE List
  • 5.23.8.191WSO2 Carbon User Management UICVE List
  • 5.24.8.3WSO2 Carbon User Management UICVE List
  • 5.25.92.99WSO2 Carbon User Management UICVE List
  • 5.25.705.3WSO2 Carbon User Management UICVE List
  • 7.0.78.43WSO2 Carbon User Management UICVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the httpOnly flag on session-related cookies, session hijacking is not possible.

Text from CVE List

Affected versions 31

  • WSO2 Enterprise Integratorunknown: all versions before 6.6.0CVE List
  • WSO2 Enterprise Integratoraffected: 6.6.0 before 6.6.0.204CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.310CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.212CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.195CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.64CVE List
  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.286CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.376CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.10CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.299CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.159CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.91CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.6CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.336CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.306CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.357CVE List
  • WSO2 Carbon User Management UIaffected: 5.14.127 before 5.14.127.6CVE List
  • WSO2 Carbon User Management UIaffected: 5.17.5 before 5.17.5.273CVE List
  • WSO2 Carbon User Management UIaffected: 5.17.118 before 5.17.118.3CVE List
  • WSO2 Carbon User Management UIaffected: 5.18.187 before 5.18.187.260CVE List
  • WSO2 Carbon User Management UIaffected: 5.18.248 before 5.18.248.12CVE List
  • WSO2 Carbon User Management UIaffected: 5.23.8 before 5.23.8.191CVE List
  • WSO2 Carbon User Management UIaffected: 5.24.8 before 5.24.8.3CVE List
  • WSO2 Carbon User Management UIaffected: 5.25.92 before 5.25.92.99CVE List
  • WSO2 Carbon User Management UIaffected: 5.25.705 before 5.25.705.3CVE List
  • WSO2 Carbon User Management UIaffected: 7.0.78 before 7.0.78.43CVE List

References 3