CVE-2025-8154

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

State: Published
Severity: 5.3 Medium
Published: May 11, 2026
Updated: May 11, 2026
Reserved: Jul 25, 2025

Description

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.

By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	WSO2

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 4.1.0Unknown 4.1.0 to before 4.1.0.218Affected 4.2.0 to before 4.2.0.164Affected 4.3.0 to before 4.3.0.74Affected 4.4.0 to before 4.4.0.38Affected 4.5.0 to before 4.5.0.20Affected
WSO2 Universal GatewayWSO2	4.5.0 to before 4.5.0.19Affected
WSO2 Traffic ManagerWSO2	4.5.0 to before 4.5.0.19Affected
WSO2 API Control PlaneWSO2	4.5.0 to before 4.5.0.21Affected
WSO2 Carbon API GatewayWSO2	9.20.74 to before 9.20.74.374Affected 9.28.116 to before 9.28.116.363Affected 9.29.120 to before 9.29.120.181Affected 9.30.67 to before 9.30.67.104Affected 9.31.86 to before 9.31.86.64Affected 9.32.2 and laterNot affected
WSO2 Carbon API Management ImplementationWSO2	9.20.74 to before 9.20.74.374Affected 9.28.116 to before 9.28.116.363Affected 9.29.120 to before 9.29.120.181Affected 9.30.67 to before 9.30.67.104Affected 9.31.86 to before 9.31.86.64Affected 9.32.2 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.