CVE-2025-10503: Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

Published Apr 29, 2026
·
Updated

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting.

An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.

Affected Software

2 affected components
WSO2 WSO2 Identity Server
WSO2 Identity Server>=7.1.0<7.1.0.28

Remediation

Information

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4577/#solution

Event History

Apr 29, 2026
CVE Published
via MITRE·08:08 AM
Data Sourced
via MITRE·08:08 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-10503?

CVE-2025-10503 is considered a critical vulnerability due to its potential for reflected cross-site scripting (XSS) attacks.

2

How do I fix CVE-2025-10503?

To fix CVE-2025-10503, ensure that proper input validation and output encoding are implemented in the authentication endpoint of WSO2 Identity Server.

3

Which software is affected by CVE-2025-10503?

CVE-2025-10503 affects WSO2 Identity Server, specifically through its authentication endpoint.

4

What kind of attacks can CVE-2025-10503 enable?

CVE-2025-10503 can enable attackers to perform reflected cross-site scripting (XSS) attacks, injecting malicious JavaScript payloads.

5

Is there a workaround for CVE-2025-10503?

While there is no official workaround for CVE-2025-10503, temporarily restricting user input on the authentication endpoint may reduce risk until a patch is applied.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203