Threats tagged 'ghsa-rc63-xm4j-4f8h'

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to insufficient output encoding. This allows attackers to inject malicious JavaScript payloads that are reflected in responses, potentially leading to browser-based attacks such as redirection to malicious sites or UI manipulation. Session cookies are protected with the httpOnly flag, reducing the risk of session hijacking via this vulnerability.