GHSA-6pqq-8j74-wgg5 · Severity: medium — The authentication endpoint accepts user-supplied input without enforcing expected validation...
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.
Conclusion & alert: CVE-2025-10503 is rated Low Risk (27/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.17%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.03% | 0.17% | +0.14% |
| 2 | 2026-04-29 | — | 0.03% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.1 | 3.1 | MEDIUM |
|
2.8 | 2.7 | ed10eef1-636d-4fbe-9993-6890dfa878f8 |
GHSA-6pqq-8j74-wgg5 · Severity: medium — The authentication endpoint accepts user-supplied input without enforcing expected validation...
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| wso2 | identity_server | >= 7.1.0, < 7.1.0.28 | cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* |