CVE-2026-2445
Description
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.
How to fix
- wso2 api_control_plane4.5.0.56, 4.6.0.20 or later
- wso2 api_manager4.2.0.195, 4.3.0.106, 4.4.0.70, 4.5.0.55, 4.6.0.19 or later
- wso2 identity_server6.0.0.263, 6.1.0.266, 7.0.0.144, 7.1.0.53, 7.2.0.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_control_plane | 4.5.0 ≤ v < 4.5.0.56, 4.6.0 ≤ v < 4.6.0.20 | 4.5.0.56, 4.6.0.20 |
| wso2 api_manager | 4.2.0 ≤ v < 4.2.0.195, 4.3.0 ≤ v < 4.3.0.106, 4.4.0 ≤ v < 4.4.0.70, 4.5.0 ≤ v < 4.5.0.55, 4.6.0 ≤ v < 4.6.0.19 | 4.2.0.195, 4.3.0.106, 4.4.0.70, 4.5.0.55, 4.6.0.19 |
| wso2 identity_server | 6.0.0 ≤ v < 6.0.0.263, 6.1.0 ≤ v < 6.1.0.266, 7.0.0 ≤ v < 7.0.0.144, 7.1.0 ≤ v < 7.1.0.53, 7.2.0 ≤ v < 7.2.0.12 | 6.0.0.263, 6.1.0.266, 7.0.0.144, 7.1.0.53, 7.2.0.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.