PT-2026-39583 · Wso2 · Wso2 Api Control Plane+9

Published 2026-05-11 · Updated 2026-05-27 · CVE-2025-8154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. A malicious actor can inject or overwrite arbitrary HTTP response headers, which may lead to the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2025-8154

Affected Products

Wso2 Api Control Plane

Wso2 Api Manager

Wso2 Carbon Api Gateway

Wso2 Carbon Api Management Implementation

Wso2 Traffic Manager

Wso2 Universal Gateway

Api Control Plane

Aimanager

Traffic Manager

Universal Gateway

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8154 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410 · Vendor Advisory
• https://t.me/CVEtracker/53362 · Telegram Post
• https://t.me/cveNotify/163019 · Telegram Post
• https://twitter.com/CVEnew/status/2053954490965877133 · Twitter Post
• https://t.me/cveNotify/164915 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053805512404173192 · Twitter Post