VULNERABILITY INTELLIGENCE

CVE-2025-8154

CVSS score5.3 MEDIUM
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-05-11
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

Weakness classification

  • ed10eef1-636d-4fbe-9993-6890dfa878f8: CWE-74

Primary references