Skip to content
Heist/ feed
Medium

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

Type: advisorySource: Official CVE List1 source record

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.

Announced Source revision 1
Original source ↗

CVE-2025-13591

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-13591

WSO2 Identity Server

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

WSO2 Carbon Abstract OTP Authenticator

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Email OTP Authenticator

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "7.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.134",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.42",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Abstract OTP Authenticator",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.5",
        "lessThan": "1.0.5.3",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.0.10",
        "lessThan": "1.0.10.2",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core",
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "Email OTP Authenticator",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.18",
        "lessThan": "1.0.18.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.0.30",
        "lessThan": "1.0.30.5",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp",
    "defaultStatus": "unknown"
  }
]
Related CVEs
CVE-2025-13591

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#42569 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement