CVE-2024-6429: 
Java vulnerability analysis and mitigation

CVE-2024-6429 is a content spoofing vulnerability affecting multiple WSO2 products due to improper error message handling in the Authentication Portal. When an authentication failure occurs, the portal previously accepted an authFailureMsg value supplied via URL parameters and rendered it in the UI without validating it against the resource bundle, allowing attackers to inject arbitrary content. Affected products include WSO2 Identity Server (versions 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0) and WSO2 API Manager (versions 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0). The vulnerability was published on September 23, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, WSO2 Advisory).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), where the Authentication Portal accepted the authFailureMsg URL parameter and rendered it directly in the error banner without validating it against the application's resource bundle or encoding the input before display. An unauthenticated remote attacker can craft a malicious URL containing arbitrary text in the authFailureMsg parameter; when a victim clicks the link, the browser renders the attacker-controlled content as a legitimate error message in the WSO2 portal UI. The fix, introduced in org.wso2.identity.apps:authentication-portal version 2.4.4, validates the message key against the resource bundle and encodes input before rendering (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an attacker to display arbitrary, attacker-controlled text in the WSO2 Authentication Portal's error banner, enabling social engineering attacks against users who trust the portal's UI. This could be used to trick users into revealing credentials, performing unintended actions, or believing false information presented as a legitimate system message. There is no direct confidentiality or availability impact; the integrity impact is limited to UI misrepresentation (GitHub Advisory, WSO2 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.05% per GitHub Advisory), placing it in the 16th percentile for exploitation likelihood. Exploitation requires user interaction — a victim must click a crafted link — which limits the attack surface.

1. Reconnaissance: Identify publicly accessible WSO2 Identity Server or API Manager instances running vulnerable versions (Identity Server < 7.0.0.48, < 6.1.0.176, < 6.0.0.203, < 5.11.0.359, < 5.10.0.314; API Manager < 4.4.0.4, < 4.3.0.38, < 4.2.0.128, < 4.1.0.188, < 4.0.0.327, < 3.2.1.33, < 3.2.0.409).
2. Craft malicious URL: Construct a URL targeting the WSO2 Authentication Portal login page that includes a crafted authFailureMsg parameter containing attacker-controlled text, e.g., https://target.example.com/authenticationendpoint/login.do?authFailureMsg=Your+session+has+expired.+Please+re-enter+your+credentials+at+http://attacker.example.com.
3. Deliver the link: Send the crafted URL to a target user via phishing email, instant message, or other social engineering channel, making it appear to be a legitimate WSO2 portal link.
4. Victim interaction: When the victim clicks the link, the WSO2 Authentication Portal renders the attacker-supplied text as a legitimate error message in the UI error banner.
5. Social engineering: The victim, trusting the portal's appearance, may follow instructions embedded in the fake error message — such as visiting a phishing site, entering credentials, or taking other unintended actions (GitHub Advisory, WSO2 Advisory).

• Network: HTTP requests to the WSO2 Authentication Portal (e.g., /authenticationendpoint/login.do) containing unusual or lengthy authFailureMsg URL parameters with encoded text, external URLs, or HTML content.
• Logs: Web server or application access logs showing GET requests to authentication endpoints with authFailureMsg parameters containing values not matching expected resource bundle keys; repeated requests from the same IP with varying authFailureMsg values may indicate probing.
• User Reports: End users reporting unexpected or suspicious error messages on the WSO2 login page, particularly those containing instructions to visit external sites or re-enter credentials elsewhere.

WSO2 has released patches addressing this vulnerability. Organizations should upgrade the org.wso2.identity.apps:authentication-portal Maven package to version 2.4.4 or later (GitHub Advisory). Specific patched build versions by product are: Identity Server 7.0.0.48+, 6.1.0.176+, 6.0.0.203+, 5.11.0.359+, 5.10.0.314+; API Manager 4.4.0.4+, 4.3.0.38+, 4.2.0.128+, 4.1.0.188+, 4.0.0.327+, 3.2.1.33+, 3.2.0.409+. As a temporary workaround where patching is not immediately possible, implement WAF rules or reverse proxy filters to block or sanitize requests containing unexpected authFailureMsg URL parameters, and educate users to be suspicious of unusual error messages on the login portal (WSO2 Advisory).