{"id":"CVE-2026-11854","revision":"aedc2a824dd146e889538417d6ea4e3b","records":[{"revision":"aedc2a824dd146e889538417d6ea4e3b","observedAt":"2026-10-29T03:48:01.066+00:00","statement":{"source":"cve-program","id":"CVE-2026-11854","aliases":[],"title":"Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products","description":"The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser.\n\nSuccessful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.","state":0,"publishedAt":"2026-10-28T19:21:33.216+00:00","modifiedAt":"2026-10-29T02:02:14.279+00:00","affected":[{"ecosystem":"Vendor product","name":"WSO2 API Manager","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"WSO2\",\n                    \"product\": \"WSO2 API Manager\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unknown\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.2.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.0\",\n                            \"lessThan\": \"3.2.0.480\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.1\",\n                            \"lessThan\": \"3.2.1.99\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.1.0\",\n                            \"lessThan\": \"4.1.0.265\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.2.0\",\n                            \"lessThan\": \"4.2.0.205\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.3.0\",\n                            \"lessThan\": \"4.3.0.117\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.4.0\",\n                            \"lessThan\": \"4.4.0.80\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.5.0\",\n                            \"lessThan\": \"4.5.0.65\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.6.0\",\n                            \"lessThan\": \"4.6.0.29\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.7.0\",\n                            \"lessThan\": \"4.7.0.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"WSO2 API Control Plane","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"WSO2\",\n                    \"product\": \"WSO2 API Control Plane\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unknown\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.5.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.5.0\",\n                            \"lessThan\": \"4.5.0.66\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.6.0\",\n                            \"lessThan\": \"4.6.0.30\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.7.0\",\n                            \"lessThan\": \"4.7.0.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"WSO2 Identity Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"WSO2\",\n                    \"product\": \"WSO2 Identity Server\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unknown\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.10.0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.10.0\",\n                            \"lessThan\": \"5.10.0.399\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.11.0\",\n                            \"lessThan\": \"5.11.0.446\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.0\",\n                            \"lessThan\": \"6.0.0.272\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.1.0\",\n                            \"lessThan\": \"6.1.0.274\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"7.0.0\",\n                            \"lessThan\": \"7.0.0.155\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"7.1.0\",\n                            \"lessThan\": \"7.1.0.65\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"7.2.0\",\n                            \"lessThan\": \"7.2.0.26\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4850/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-11854","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-11854","identifiers":["CVE-2026-11854"]},"retained":false,"historicalAffected":[]}],"coverage":[]}