CVE-2025-8591 describes a cross-site scripting vulnerability in WSO2 Identity Server where user-supplied input via URL parameters is not properly encoded before being reflected in the response. This improper output encoding enables attackers to inject malicious scripts that execute in the context of the victim's browser. Although the vulnerability allows actions such as redirecting users, modifying the webpage UI, or extracting browser information, the risk of session hijacking is reduced due to the use of httpOnly flags on session cookies. The affected versions explicitly include 5.10.0, 6.0.0, 7.0.0, and 7.1.0. No official patch or remediation level has been provided by the vendor at this time.

Successful exploitation can lead to execution of attacker-controlled scripts in the victim's browser, enabling redirection to malicious websites, UI manipulation, and potential information disclosure. However, session hijacking is mitigated by httpOnly cookie flags. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted URLs and consider implementing additional output encoding or input validation controls where possible. Monitor vendor communications for updates on patches or official mitigations.