CVE-2024-5139

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

State: Published
Severity: 6.1 Medium
Published: Oct 21, 2026
Updated: Oct 30, 2026
Reserved: May 20, 2024

Description

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	WSO2

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
WSO2 Enterprise IntegratorWSO2	before 6.6.0Unknown 6.6.0 to before 6.6.0.204Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.310Affected 6.0.0 to before 6.0.0.212Affected 6.1.0 to before 6.1.0.195Affected 7.0.0 to before 7.0.0.64Affected
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.286Affected 3.2.0 to before 3.2.0.376Affected 3.2.1 to before 3.2.1.10Affected 4.0.0 to before 4.0.0.299Affected 4.1.0 to before 4.1.0.159Affected 4.2.0 to before 4.2.0.91Affected 4.3.0 to before 4.3.0.6Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.336Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.306Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.357Affected
WSO2 Carbon User Management UIWSO2	5.14.127 to before 5.14.127.6Affected 5.17.5 to before 5.17.5.273Affected 5.17.118 to before 5.17.118.3Affected 5.18.187 to before 5.18.187.260Affected 5.18.248 to before 5.18.248.12Affected 5.23.8 to before 5.23.8.191Affected 5.24.8 to before 5.24.8.3Affected 5.25.92 to before 5.25.92.99Affected 5.25.705 to before 5.25.705.3Affected 7.0.78 to before 7.0.78.43Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.