CVE-2026-11854
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
WSO2 WSO2 API Manager
CVSS
6.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.2.0.480WSO2 API ManagerCVE List
- 3.2.1.99WSO2 API ManagerCVE List
- 4.1.0.265WSO2 API ManagerCVE List
- 4.2.0.205WSO2 API ManagerCVE List
- 4.3.0.117WSO2 API ManagerCVE List
- 4.4.0.80WSO2 API ManagerCVE List
Show all 19 fixed versions
- 4.5.0.65WSO2 API ManagerCVE List
- 4.6.0.29WSO2 API ManagerCVE List
- 4.7.0.1WSO2 API ManagerCVE List
- 4.5.0.66WSO2 API Control PlaneCVE List
- 4.6.0.30WSO2 API Control PlaneCVE List
- 4.7.0.1WSO2 API Control PlaneCVE List
- 5.10.0.399WSO2 Identity ServerCVE List
- 5.11.0.446WSO2 Identity ServerCVE List
- 6.0.0.272WSO2 Identity ServerCVE List
- 6.1.0.274WSO2 Identity ServerCVE List
- 7.0.0.155WSO2 Identity ServerCVE List
- 7.1.0.65WSO2 Identity ServerCVE List
- 7.2.0.26WSO2 Identity ServerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser.
Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
Text from CVE List
Affected versions 22
- WSO2 API Managerunknown: all versions before 3.2.0CVE List
- WSO2 API Manageraffected: 3.2.0 before 3.2.0.480CVE List
- WSO2 API Manageraffected: 3.2.1 before 3.2.1.99CVE List
- WSO2 API Manageraffected: 4.1.0 before 4.1.0.265CVE List
- WSO2 API Manageraffected: 4.2.0 before 4.2.0.205CVE List
- WSO2 API Manageraffected: 4.3.0 before 4.3.0.117CVE List
- WSO2 API Manageraffected: 4.4.0 before 4.4.0.80CVE List
- WSO2 API Manageraffected: 4.5.0 before 4.5.0.65CVE List
- WSO2 API Manageraffected: 4.6.0 before 4.6.0.29CVE List
- WSO2 API Manageraffected: 4.7.0 before 4.7.0.1CVE List
- WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
- WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.66CVE List
- WSO2 API Control Planeaffected: 4.6.0 before 4.6.0.30CVE List
- WSO2 API Control Planeaffected: 4.7.0 before 4.7.0.1CVE List
- WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
- WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.399CVE List
- WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.446CVE List
- WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.272CVE List
- WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.274CVE List
- WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.155CVE List
- WSO2 Identity Serveraffected: 7.1.0 before 7.1.0.65CVE List
- WSO2 Identity Serveraffected: 7.2.0 before 7.2.0.26CVE List