CVE-2025-10503: Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting.
An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10503?
CVE-2025-10503 is considered a critical vulnerability due to its potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2025-10503?
To fix CVE-2025-10503, ensure that proper input validation and output encoding are implemented in the authentication endpoint of WSO2 Identity Server.
Which software is affected by CVE-2025-10503?
CVE-2025-10503 affects WSO2 Identity Server, specifically through its authentication endpoint.
What kind of attacks can CVE-2025-10503 enable?
CVE-2025-10503 can enable attackers to perform reflected cross-site scripting (XSS) attacks, injecting malicious JavaScript payloads.
Is there a workaround for CVE-2025-10503?
While there is no official workaround for CVE-2025-10503, temporarily restricting user input on the authentication endpoint may reduce risk until a patch is applied.