CVE-2025-13591
Description
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.
How to fix
- WSO2 WSO2 Identity Server7.0.0.134, 7.1.0.42 or later
- WSO2 WSO2 Carbon Abstract OTP Authenticator1.0.5.3, 1.0.10.2 or later
- WSO2 Email OTP Authenticator1.0.18.8, 1.0.30.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.134, 7.1.0 ≤ v < 7.1.0.42 | 7.0.0.134, 7.1.0.42 |
| WSO2 WSO2 Carbon Abstract OTP Authenticator | 1.0.5 ≤ v < 1.0.5.3, 1.0.10 ≤ v < 1.0.10.2 | 1.0.5.3, 1.0.10.2 |
| WSO2 Email OTP Authenticator | 1.0.18 ≤ v < 1.0.18.8, 1.0.30 ≤ v < 1.0.30.5 | 1.0.18.8, 1.0.30.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.