Vulnerability in WSO2 API Manager

[ Description ]Official description

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund29 Oct 2026WID-SEC-2026-4251

  WSO2 API Manager: Multiple vulnerabilities Translated from German

  CVE-2026-11854CVE-2026-3583

[ References ]References

• security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2…