CVE-2025-6024
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.
Published Apr 16, 2026 · updated Oct 14, 2026 · wso2 api manager
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Timeline
Detection, updates, and resolution for this record.
Apr 16, 2026 · NIST NVD
Detected
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browse
Oct 14, 2026 · NIST NVD
Updated
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browse
Affected
- cpe wso2/api manager3.1.0
- cpe wso2/api manager3.2.0
- cpe wso2/api manager3.2.1
- cpe wso2/api manager4.0.0
- cpe wso2/api manager4.1.0
- cpe wso2/identity server5.10.0
- cpe wso2/identity server5.11.0
Sources
- CVE.orgCVE-2025-6024
Official CVE identifier
cve.org - NIST NVDCVE-2025-6024
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirecte
nvd.nist.gov