Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
7 versions affected across 2 products
CVE-2025-6024 The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by inj… https://www.cve.org/CVERecord?id=CVE-2025-6024
Post summary
The CVE discloses an XSS vulnerability in the authentication endpoint due to missing input encoding, but no PoC, exploit, active exploitation, or patch information is provided.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wso2 | api_manager | 3.1.0 | - | - |
| App | wso2 | api_manager | 3.2.0 | - | - |
| App | wso2 | api_manager | 3.2.1 | - | - |
| App | wso2 | api_manager | 4.0.0 | - | - |
| App | wso2 | api_manager | 4.1.0 | - | - |
| App | wso2 | identity_server | 5.10.0 | - | - |
| App | wso2 | identity_server | 5.11.0 | - | - |