Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WSO2 | WSO2 Identity Server | unaffected |
|
||||||||||||||||||
| WSO2 | WSO2 API Manager | unaffected |
|
||||||||||||||||||
| WSO2 | WSO2 API Control Plane | unaffected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Wso2 | Api Control Plane | — | — |
| Wso2 | Api Manager | — | — |
| Wso2 | Identity Server | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4270/#solution
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 13 Nov 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:* |
Thu, 06 Nov 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wso2
Wso2 api Control Plane Wso2 api Manager Wso2 identity Server |
|
| Vendors & Products |
Wso2
Wso2 api Control Plane Wso2 api Manager Wso2 identity Server |
Wed, 05 Nov 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector. | |
| Title | Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2025-11-05T20:13:05.330Z
Reserved: 2025-06-06T06:00:39.196Z
Link: CVE-2025-5770
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2025-11-05T19:16:01.880
Modified: 2025-11-13T15:32:16.473
Link: CVE-2025-5770
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-11-06T10:06:54Z