InfoSec Signals™
Sign InStart Free
Back to CVE records
Medium 6.1Published Oct 21, 2026

CVE-2024-5139Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

Updated under an hour ago ()

Does this affect you?

It affects WSO2 Enterprise Integrator and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

CVSS
6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
WSO2
NVD analysis
Awaiting Analysis
Record last updated
Oct 21, 2026
First seen by InfoSec Signals
Oct 21, 2026

Affected products

Affected products
WSO2 WSO2 Enterprise Integrator
wso2:enterprise_integrator (from the name)
before 6.6.0 status unknown; from 6.6.0 before 6.6.0.204
CNA record
WSO2 WSO2 Identity Server
wso2:identity_server (from the name)
before 5.10.0 status unknown; from 5.10.0 before 5.10.0.310; from 6.0.0 before 6.0.0.212; from 6.1.0 before 6.1.0.195; from 7.0.0 before 7.0.0.64
CNA record
WSO2 WSO2 API Manager
wso2:api_manager (from the name)
before 3.1.0 status unknown; from 3.1.0 before 3.1.0.286; from 3.2.0 before 3.2.0.376; from 3.2.1 before 3.2.1.10; from 4.0.0 before 4.0.0.299; from 4.1.0 before 4.1.0.159; from 4.2.0 before 4.2.0.91; from 4.3.0 before 4.3.0.6
CNA record
WSO2 WSO2 Open Banking AM
wso2:open_banking_am (from the name)
before 2.0.0 status unknown; from 2.0.0 before 2.0.0.336
CNA record
WSO2 WSO2 Identity Server as Key Manager
wso2:identity_server_as_key_manager (from the name)
before 5.10.0 status unknown; from 5.10.0 before 5.10.0.306
CNA record
WSO2 WSO2 Open Banking IAM
wso2:open_banking_iam (from the name)
before 2.0.0 status unknown; from 2.0.0 before 2.0.0.357
CNA record
WSO2 WSO2 Carbon User Management UI
wso2:carbon_user_management_ui (from the name)
from 5.14.127 before 5.14.127.6; from 5.17.5 before 5.17.5.273; from 5.17.118 before 5.17.118.3; from 5.18.187 before 5.18.187.260; from 5.18.248 before 5.18.248.12; from 5.23.8 before 5.23.8.191; from 5.24.8 before 5.24.8.3; from 5.25.92 before 5.25.92.99; and 2 more ranges
CNA record

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.