CVE-2024-5139CWE-79cross-site-scripting

CVE-2024-5139

Medium · published October 21, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-21T18:17Z
References (3)
https://github.com/wso2/carbon-identity-framework/pull/5740 · ed10eef1-636d-4fbe-9993-6890dfa878f8https://github.com/wso2/carbon-identity-framework/pull/5741 · ed10eef1-636d-4fbe-9993-6890dfa878f8https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/ · ed10eef1-636d-4fbe-9993-6890dfa878f8
EPSS history
Timeline
  • 23 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 21 OCT 13:36Z
    Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
    cvelistv5
  • 21 OCT 13:36Z
    Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
    cvelistv5