The vulnerability CVE-2025-8154 in WSO2 API Manager arises from insufficient validation or sanitization of user-supplied input in HTTP request headers during Webhook API calls. This allows attackers to inject or overwrite arbitrary HTTP response headers. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Affected versions include 4.1.0 through 4.5.0. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity loss without confidentiality or availability impact. No official remediation or patch is currently documented.

Exploitation of this vulnerability can lead to injection or modification of HTTP response headers, which may allow attackers to manipulate browser caching policies, alter security-related headers, or expose sensitive information such as cookies. This could potentially enable session hijacking or other malicious activities that rely on tampering with HTTP responses. There is no indication of direct confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor WSO2 advisories for updates. Until a patch is available, consider implementing input validation or sanitization controls on Webhook API inputs where feasible to mitigate injection risks.