Back to overview

CVE-2026-2445

MEDIUM
6.1
CVSS 3.1
Description
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Metadata

CVE ID
CVE-2026-2445
State
PUBLISHED
Assigner
WSO2
Reserved
2026-02-13 07:48 UTC
Published
2026-07-20 08:06 UTC
Last updated
2026-07-20 13:52 UTC
Primary CWE
CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product
WSO2 / WSO2 API Manager
Sources
cve.org  ·  NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (3)
VendorProductPlatformVersions
WSO2 WSO2 API Control Plane — 4.5.0 < 4.5.0.56, 4.6.0 < 4.6.0.20
WSO2 WSO2 API Manager — 4.2.0 < 4.2.0.195, 4.3.0 < 4.3.0.106, 4.4.0 < 4.4.0.70, 4.5.0 < 4.5.0.55 …
WSO2 WSO2 Identity Server — 6.0.0 < 6.0.0.263, 6.1.0 < 6.1.0.266, 7.0.0 < 7.0.0.144, 7.1.0 < 7.1.0.53 …
Weakness (CWE)
CWESourceDescription
CWE-79 cna CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.1 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References (1)
Back to overview