WSO2 Identity Server 7.1.0 contains a reflected XSS vulnerability (CWE-79) in its authentication endpoint due to improper input validation and output encoding. This flaw allows attackers to inject malicious JavaScript that executes in the context of the victim's browser. While the vulnerability can be used to redirect users or manipulate the web interface, session cookies are protected with the httpOnly flag, preventing session hijacking. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation can result in execution of arbitrary JavaScript in the victim's browser, enabling actions such as redirecting the user to malicious sites, altering the user interface, or extracting information accessible to the browser. However, session hijacking is not possible due to the httpOnly flag on session cookies. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from WSO2 or restrict access to the affected authentication endpoint. Monitor vendor communications for updates on patches or official mitigations.