Vulnerability Intelligence Report
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
CVE-2025-8154
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
No Active Exploit Signals
CVSS Base Score
5.3
MEDIUM
Exploitability:3.9
Impact Score:1.5
EPSS Probability:0.19%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-74 ↗CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 0 < 4.1.0 (unknown), 4.1.0 < 4.1.0.218 (affected), 4.2.0 < 4.2.0.164 (affected), 4.3.0 < 4.3.0.74 (affected), 4.4.0 < 4.4.0.38 (affected), 4.5.0 < 4.5.0.20 (affected) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 < 4.5.0.19 (affected) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 < 4.5.0.19 (affected) |
| WSO2 | WSO2 API Control Plane | 4.5.0 < 4.5.0.21 (affected) |
| WSO2 | WSO2 Carbon API Gateway | 9.20.74 < 9.20.74.374 (affected), 9.28.116 < 9.28.116.363 (affected), 9.29.120 < 9.29.120.181 (affected), 9.30.67 < 9.30.67.104 (affected), 9.31.86 < 9.31.86.64 (affected), 9.32.2 <= * (unaffected) |
| WSO2 | WSO2 Carbon API Management Implementation | 9.20.74 < 9.20.74.374 (affected), 9.28.116 < 9.28.116.363 (affected), 9.29.120 < 9.29.120.181 (affected), 9.30.67 < 9.30.67.104 (affected), 9.31.86 < 9.31.86.64 (affected), 9.32.2 <= * (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.186%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | WSO2 LLC · Vendor · USA |
| Reserved | 2025-07-25T06:42:23 |
| Published | 2026-05-11T09:30:36 |
| Last Updated | 2026-05-11T12:43:47 |
Community Chatter & Buzz