---
id: CVE-2025-8154
title: >-
  In Webhook API invocations, the component accepts user-supplied input for HTTP
  request headers without sufficient validation or sanitization, allowing these
  headers to be injected into HTTP responses.


  By exploiting this vulnerability, a…
summary: >-
  In Webhook API invocations, the component accepts user-supplied input for HTTP
  request headers without sufficient validation or sanitization, allowing these
  headers to be injected into HTTP responses.


  By exploiting this vulnerability, a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-74
vendor: wso2
product: api_control_plane
affected:
  - 'api_control_plane >= 4.5.0, < 4.5.0.21'
  - 'api_manager >= 4.1.0, < 4.1.0.218'
  - 'api_manager >= 4.2.0, < 4.2.0.164'
  - 'api_manager >= 4.3.0, < 4.3.0.74'
  - 'api_manager >= 4.4.0, < 4.4.0.38'
  - 'api_manager >= 4.5.0, < 4.5.0.20'
  - 'traffic_manager >= 4.5.0, < 4.5.0.19'
  - 'universal_gateway >= 4.5.0, < 4.5.0.19'
patched:
  - api_control_plane 4.5.0.21
  - api_manager 4.5.0.20
  - traffic_manager 4.5.0.19
  - universal_gateway 4.5.0.19
published: '2026-05-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8154'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
tags:
  - nvd
epss: 0.00186
epssPercentile: 0.07581
ingestedAt: '2026-10-14T13:30:58.493Z'
---

## Overview

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.

By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

## Affected

- `api_control_plane >= 4.5.0, < 4.5.0.21`
- `api_manager >= 4.1.0, < 4.1.0.218`
- `api_manager >= 4.2.0, < 4.2.0.164`
- `api_manager >= 4.3.0, < 4.3.0.74`
- `api_manager >= 4.4.0, < 4.4.0.38`
- `api_manager >= 4.5.0, < 4.5.0.20`
- `traffic_manager >= 4.5.0, < 4.5.0.19`
- `universal_gateway >= 4.5.0, < 4.5.0.19`

## Remediation

Upgrade past the affected range:

- `api_control_plane 4.5.0.21`
- `api_manager 4.5.0.20`
- `traffic_manager 4.5.0.19`
- `universal_gateway 4.5.0.19`