The WSO2 API Manager contains a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in its authentication endpoint. This flaw allows an attacker to inject malicious scripts because user-supplied input is not encoded before rendering. The vulnerability affects multiple versions from 3.1.0 to 4.1.0. While exploitation can cause browser redirection, UI manipulation, and information disclosure, session cookies are protected by the httpOnly flag, preventing session hijacking. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation can result in client-side impacts such as redirection to malicious websites, manipulation of the web page interface, and unauthorized access to information within the user's browser context. The vulnerability does not allow session hijacking due to the httpOnly flag on cookies. The overall impact is limited to confidentiality and integrity at the browser level, with no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Additionally, users should monitor official WSO2 communications for updates regarding patches or mitigations. No vendor advisory content is currently available indicating that the issue is already mitigated or that no action is required.