CVE-2025-0209Medium· 6.1▾ SunlitA reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser.
This vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking.
identity_server = 7.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10503Medium· 6.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding
CVE-2025-12624Medium· 6.0Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser
CVE-2025-14779Low· 3.8The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type
CVE-2025-13909Medium· 4.3The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators
CVE-2025-11850Medium· 4.3When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks