CVE-2025-6024: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-6024 is a reflected Cross-Site Scripting (XSS) vulnerability in the authentication endpoints of multiple WSO2 products, caused by failure to encode user-supplied input before rendering it in the web page. It affects WSO2 Identity Server versions 5.10.0 and 5.11.0, and WSO2 API Manager versions 3.1.0, 3.2.0, 3.2.1, 4.0.0, and 4.1.0. The vulnerability was published on April 16, 2026, with WSO2 as the assigning CNA. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, WSO2 Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where user-supplied input passed to the authentication endpoint is reflected back into the HTML response without proper output encoding. This is a network-accessible, low-complexity attack requiring no privileges but requiring user interaction (e.g., a victim clicking a crafted link), making it consistent with reflected XSS behavior. An attacker crafts a malicious URL targeting the authentication endpoint with an injected script payload, which executes in the victim's browser when the link is visited. Session hijacking is explicitly mitigated by the httpOnly flag on session cookies, limiting the attacker's ability to steal session tokens (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser within the context of the affected WSO2 application. Potential consequences include redirecting users to malicious websites, manipulating the authentication page's UI (e.g., credential harvesting via fake login forms), and exfiltrating browser-accessible information such as DOM content or non-httpOnly cookies. Availability is not impacted, and session hijacking via cookie theft is prevented by the httpOnly flag, limiting the severity to low confidentiality and low integrity impacts (GitHub Advisory, WSO2 Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible WSO2 Identity Server or API Manager instances running affected versions (5.10.0/5.11.0 for IS; 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0 for APIM) using tools like Shodan or Censys, or by inspecting login page headers/footers for version indicators.
2. Identify the vulnerable endpoint: Locate the authentication/login endpoint (e.g., /authenticationendpoint/login.do or similar WSO2 authentication pages) that reflects user-supplied parameters in the response.
3. Craft a malicious URL: Construct a URL targeting the authentication endpoint with an XSS payload injected into a vulnerable query parameter, for example: https://target.example.com/authenticationendpoint/login.do?param=<script>malicious_code_here</script>.
4. Deliver the payload: Send the crafted URL to a victim via phishing email, social engineering, or embedding it in a malicious website, inducing the victim to click the link.
5. Script execution: When the victim's browser loads the page, the unencoded input is rendered as HTML, causing the injected script to execute in the victim's browser context — enabling UI manipulation, credential phishing overlay, or data exfiltration to an attacker-controlled server (GitHub Advisory, WSO2 Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting the WSO2 authentication page; unusual redirects originating from the WSO2 login endpoint.
• Logs: WSO2 access logs showing requests to the authentication endpoint containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters; repeated requests from the same IP with varying XSS payloads suggesting probing activity.
• Browser/Client-Side: Unexpected JavaScript execution or page redirects when accessing the WSO2 login page; browser developer tools showing script sources from external domains loaded within the WSO2 authentication page context.

WSO2 has released patches for all affected products. Apply the following minimum update versions: WSO2 API Manager 3.1.0 → update 3.1.0.351+, 3.2.0 → 3.2.0.455+, 3.2.1 → 3.2.1.74+, 4.0.0 → 4.0.0.375+, 4.1.0 → 4.1.0.238+; WSO2 Identity Server 5.10.0 → 5.10.0.360+, 5.11.0 → 5.11.0.405+ (WSO2 Advisory). As a defense-in-depth measure, implement a Content Security Policy (CSP) header to restrict script execution sources on authentication pages. Organizations should also verify that all user-supplied input is properly output-encoded before rendering in web pages.