CVE-2026-2445

Name of the Vulnerable Software and Affected Versions WSO2 Products (affected versions not specified)

Description The product fails to properly sanitize or encode user-supplied input provided via a URL parameter before rendering it in the response. This allows for Reflected Cross-Site Scripting (XSS), where an attacker can inject malicious JavaScript payloads. This can lead to the redirection of the user's browser to malicious websites, modification of the webpage user interface, or the retrieval of sensitive information from the browser. The risk of session hijacking is reduced because session-related cookies are protected by the httpOnly flag, which prevents client-side scripts from accessing them.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.