Vulnerabilitymedium
Apache Axis2/Java 2.0.1 before 2.0.2 has XSS in OpenAPI module (CVE-2026-123766)
Original title: CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
AI summary · x-ai/grok-4.7Summaries by Vani AI
The Swagger UI page writes the Host header into the page without encoding
Apache Axis2/Java has an improper neutralization of input during web page generation vulnerability in the OpenAPI module. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding.
Key facts
- Affected versions: Apache Axis2/Java 2.0.1 before 2.0.2
- Severity: moderate
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123766 | XSS in Apache Axis2/Java OpenAPI module before 2.0.2 | — | — |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2. 0. 1 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.