Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-5139 Details

Description

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: WSO2 LLCCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/wso2/carbon-identity-framework/pull/5740	WSO2 LLC
https://github.com/wso2/carbon-identity-framework/pull/5741	WSO2 LLC
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/	WSO2 LLC

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	WSO2 LLC

Affected Products

No affected product data is available for this CVE.

Change History

3 change records found show changes

Date	Action	Recorded By
Oct 30, 2026	CVE Modified	CISA-ADP
Oct 27, 2026	CVE Translated	[email protected]
Oct 21, 2026	New CVE Received	WSO2 LLC