Apache Axis2/Java 2.0.1 before 2.0.2 has XSS in OpenAPI module (CVE-2026-123766)
The Swagger UI page writes the Host header into the page without encoding
40
CVE-2026-123766
XSS in Apache Axis2/Java OpenAPI module before 2.0.2
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Cross-site scripting flaw in Apache Axis2/Java OpenAPI module's Swagger UI. The page writes request Host header value without encoding, enabling script injection in the Axis2 origin. Affects Apache Axis2/Java 2.0.1 users accessing the module. Attackers can execute scripts in the Axis2 context.
What to do: Upgrade to Apache Axis2/Java 2.0.2. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | 2.0.1 | 2.0.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Weakness
- CWE-79