CVE-2026-11854 json
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
published 2026-10-28 11 d ago modified 2026-10-29 11 d ago also EUVD-2026-112399
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser.
Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
Patch / fix
- WSO2 WSO2 API Manager 3.2.0.480, 3.2.1.99, 4.1.0.265, 4.2.0.205, 4.3.0.117, 4.4.0.80, 4.5.0.65, 4.6.0.29, 4.7.0.1
- WSO2 WSO2 API Control Plane 4.5.0.66, 4.6.0.30, 4.7.0.1
- WSO2 WSO2 Identity Server 5.10.0.399, 5.11.0.446, 6.0.0.272, 6.1.0.274, 7.0.0.155, 7.1.0.65, 7.2.0.26
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- WSO2 WSO2 API Manager
- WSO2 WSO2 API Control Plane
- WSO2 WSO2 Identity Server
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- CVE List CVE-2026-11854
- NVD CVE-2026-11854
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.