WSO2 Products Reflected Cross-Site Scripting Vulnerability in Authentication Endpoint

A reflected cross-site scripting vulnerability has been identified in the authentication endpoint of multiple WSO2 products. This issue arises from inadequate output encoding of user-supplied input, allowing malicious actors to inject arbitrary JavaScript into the authentication process. Exploitation of this vulnerability could result in user interface modifications, redirections to harmful websites, or data exfiltration from the browser. Although this vulnerability could enable manipulation of the user's browser, session-related sensitive cookies are safeguarded with the httpOnly flag, preventing session hijacking.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.