This vulnerability (CVE-2025-8154) in WSO2 API Manager arises from insufficient validation or sanitization of user-supplied input in HTTP request headers during Webhook API invocations. The flaw enables injection or overwriting of HTTP response headers, which can affect browser behavior and security controls by manipulating caching policies, security headers, or leaking sensitive data like cookies. The CVSS 3.1 base score is 5.3, indicating a medium impact primarily due to integrity concerns without direct confidentiality or availability impact. Affected versions include 4.1.0 through 4.5.0. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation allows an attacker to inject or overwrite HTTP response headers, which can lead to manipulation of browser caching, alteration of security-related headers, and potential exposure of sensitive information such as cookies. This may facilitate session hijacking or other malicious activities impacting the integrity of HTTP responses. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or sanitization controls on HTTP headers at the application or API gateway level to mitigate injection risks. Monitor vendor communications for updates on patches or official mitigations.