PT-2026-39583 · Wso2 · Wso2 Api Control Plane+5

Published 2026-05-11 · Updated 2026-05-11 · CVE-2025-8154

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.

By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2025-8154

Affected Products

Wso2 Api Control Plane

Wso2 Api Manager

Wso2 Carbon Api Gateway

Wso2 Carbon Api Management Implementation

Wso2 Traffic Manager

Wso2 Universal Gateway

References · 2

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8154 · Security Note