Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-11854— Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

身份验证端点生成的错误消息直接包含了来自请求的反射数据，且未经过充分的清理或编码。这使得攻击者能够注入恶意脚本，并在受害者的浏览器上下文中执行。 成功利用该漏洞后，攻击者可在用户浏览器内执行操作，例如将用户重定向至恶意网站、修改网页的用户界面或窃取信息。但由于会话相关 Cookie 设置了 httpOnly 标志，因此无法实施会话劫持或类似攻击。

CVSS 6.1 · Medium

Affected Version Matrix 22

VendorProduct Version RangeStatus
WSO2 WSO2 API Control Plane < 4.5.0 unknown
4.5.0< 4.5.0.66 affected
4.6.0< 4.6.0.30 affected
4.7.0< 4.7.0.1 affected
WSO2 WSO2 API Manager < 3.2.0 unknown
3.2.0< 3.2.0.480 affected
3.2.1< 3.2.1.99 affected
4.1.0< 4.1.0.265 affected
4.2.0< 4.2.0.205 affected
4.3.0< 4.3.0.117 affected
4.4.0< 4.4.0.80 affected
4.5.0< 4.5.0.65 affected
… +2 more rows
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.399 affected
5.11.0< 5.11.0.446 affected
6.0.0< 6.0.0.272 affected
6.1.0< 6.1.0.274 affected
7.0.0< 7.0.0.155 affected
7.1.0< 7.1.0.65 affected
7.2.0< 7.2.0.26 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-11854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
Source: CVE Program / CVE List V5
Vulnerability Description
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 3.2.0 ~ 3.2.0.480 -
WSO2 WSO2 API Control Plane 4.5.0 ~ 4.5.0.66 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.399 -

II. Public POCs for CVE-2026-11854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-11854

请登录查看更多情报信息。

Other References for CVE-2026-11854 (1)

Same Patch Batch · WSO2 · 2026-10-28 · 5 CVEs total

CVE-2026-78674 8.8 HIGH Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrar
CVE-2025-14260 8.3 HIGH Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and Extern
CVE-2026-6647 7.4 HIGH Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continu
CVE-2026-3583 3.1 LOW Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupte

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-79