CVE-2026-2445 is a CWE-79 cross-site scripting vulnerability in WSO2 API Manager that arises from accepting user-supplied input in a URL parameter without proper sanitization or encoding before rendering it in the response. This flaw enables attackers to inject malicious JavaScript payloads, which can redirect users to malicious sites, alter the webpage interface, or extract sensitive browser information. The risk of session hijacking is mitigated by the use of the httpOnly flag on session cookies. Affected versions explicitly include 4.2.0, 4.3.0, 4.4.0, 4.5.0, and 4.6.0. There is no vendor advisory indicating an available patch or fix at this time.

Exploitation of this vulnerability can lead to browser redirection to malicious websites, unauthorized modification of the webpage's user interface, and theft of sensitive information accessible via the browser. However, session hijacking is less likely because session cookies are protected with the httpOnly attribute, preventing JavaScript access. The overall impact is rated medium with a CVSS score of 6.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls at their own application layer to mitigate injection risks. Monitor vendor communications for updates on patches or official mitigations.