CVE-2025-0209

A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser. This vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3902/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de cross-site scripting (XSS) reflejado existe en el flujo de registro de cuentas de WSO2 Identity Server debido a una codificación de salida incorrecta. Un actor malicioso puede explotar esta vulnerabilidad inyectando una carga útil manipulada que se refleja en la respuesta del servidor, permitiendo la ejecución de JavaScript arbitrario en el navegador de la víctima. Esta vulnerabilidad podría permitir a los atacantes redirigir a los usuarios a sitios web maliciosos, modificar la interfaz de usuario o exfiltrar datos del navegador. Sin embargo, las cookies sensibles relacionadas con la sesión están protegidas usando la bandera httpOnly, lo que mitiga el riesgo de secuestro de sesión.

Information

Published : 2025-09-23 18:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-0209

Mitre link : CVE-2025-0209

CVE.ORG link : CVE-2025-0209

JSON object : View

Products Affected

wso2

identity_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-0209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T18:30:48.378651Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.87", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-23T18:15:29.833", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3902/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser.\n\nThis vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) reflejado existe en el flujo de registro de cuentas de WSO2 Identity Server debido a una codificaci\u00f3n de salida incorrecta. Un actor malicioso puede explotar esta vulnerabilidad inyectando una carga \u00fatil manipulada que se refleja en la respuesta del servidor, permitiendo la ejecuci\u00f3n de JavaScript arbitrario en el navegador de la v\u00edctima.\n\nEsta vulnerabilidad podr\u00eda permitir a los atacantes redirigir a los usuarios a sitios web maliciosos, modificar la interfaz de usuario o exfiltrar datos del navegador. Sin embargo, las cookies sensibles relacionadas con la sesi\u00f3n est\u00e1n protegidas usando la bandera httpOnly, lo que mitiga el riesgo de secuestro de sesi\u00f3n."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}