CVE-2025-8154: HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

Published May 11, 2026
·
Updated

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.

By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Affected Software

8 affected components
WSO2 Api Control Plane>=4.5.0<4.5.0.21
WSO2 API Manager>=4.1.0<4.1.0.218
WSO2 API Manager>=4.2.0<4.2.0.164
WSO2 API Manager>=4.3.0<4.3.0.74
WSO2 API Manager>=4.4.0<4.4.0.38
WSO2 API Manager>=4.5.0<4.5.0.20
WSO2 Traffic Manager>=4.5.0<4.5.0.19
WSO2 Universal Gateway>=4.5.0<4.5.0.19

Remediation

Information

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution

Event History

May 11, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-8154?

The severity of CVE-2025-8154 is rated high with a CVSS score of 7.5.

2

What type of attack does CVE-2025-8154 facilitate?

CVE-2025-8154 facilitates HTTP header injection attacks through the Webhook API in various WSO2 products.

3

How can I protect my systems from CVE-2025-8154?

To protect against CVE-2025-8154, implement proper validation and sanitization of user-supplied input for HTTP request headers.

4

Which WSO2 products are affected by CVE-2025-8154?

CVE-2025-8154 affects WSO2 API Manager, WSO2 Api Control Plane, WSO2 Traffic Manager, and WSO2 Universal Gateway.

5

What is the impact of exploiting CVE-2025-8154?

Exploiting CVE-2025-8154 allows a malicious actor to inject or overwrite arbitrary HTTP response headers.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203