Strix
72.6K

CVE-2026-11854

MEDIUMCVSS 6.1/10

Last modified

CVE-2026-11854 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information.

Description

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 API Manager< 3.2.0; >= 3.2.0, < 3.2.0.480; >= 3.2.1, < 3.2.1.99; >= 4.1.0, < 4.1.0.265; >= 4.2.0, < 4.2.0.205; >= 4.3.0, < 4.3.0.117; >= 4.4.0, < 4.4.0.80; >= 4.5.0, < 4.5.0.65; >= 4.6.0, < 4.6.0.29; >= 4.7.0, < 4.7.0.1
WSO2WSO2 API Control Plane< 4.5.0; >= 4.5.0, < 4.5.0.66; >= 4.6.0, < 4.6.0.30; >= 4.7.0, < 4.7.0.1
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.399; >= 5.11.0, < 5.11.0.446; >= 6.0.0, < 6.0.0.272; >= 6.1.0, < 6.1.0.274; >= 7.0.0, < 7.0.0.155; >= 7.1.0, < 7.1.0.65; >= 7.2.0, < 7.2.0.26

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-11854?
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
How severe is CVE-2026-11854?
CVE-2026-11854 has a CVSS score of 6.1/10 (MEDIUM severity).
How do I fix CVE-2026-11854?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-11854?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST