CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4353/

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El flujo de OTP por SMS no gestiona adecuadamente los mensajes de error, permitiendo a un atacante inferir la existencia de cuentas de usuario registradas basándose en las respuestas recibidas durante el proceso de inicio de OTP. Esta vulnerabilidad puede ser explotada por un atacante para descubrir nombres de usuario válidos dentro del sistema. El impacto se amplifica para las cuentas que no han configurado un número de móvil, ya que la enumeración está específicamente ligada a esta condición. El descubrimiento de estos nombres de usuario puede facilitar ataques de fuerza bruta posteriores, intentos de ingeniería social y la fuga de información, lo que podría provocar daños a la reputación, pérdida de confianza del cliente e incumplimiento normativo.

Information

Published : 2026-09-15 10:17

Updated : 2026-10-14 19:10

NVD link : CVE-2025-13166

Mitre link : CVE-2025-13166

CVE.ORG link : CVE-2025-13166

JSON object : View

Products Affected

No product.

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2025-13166", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13166", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T12:43:12.334732Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.40", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThan": "7.2.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-15T10:17:00.877", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4353/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.\n\nThis weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance."}, {"lang": "es", "value": "El flujo de OTP por SMS no gestiona adecuadamente los mensajes de error, permitiendo a un atacante inferir la existencia de cuentas de usuario registradas bas\u00e1ndose en las respuestas recibidas durante el proceso de inicio de OTP.\n\nEsta vulnerabilidad puede ser explotada por un atacante para descubrir nombres de usuario v\u00e1lidos dentro del sistema. El impacto se amplifica para las cuentas que no han configurado un n\u00famero de m\u00f3vil, ya que la enumeraci\u00f3n est\u00e1 espec\u00edficamente ligada a esta condici\u00f3n. El descubrimiento de estos nombres de usuario puede facilitar ataques de fuerza bruta posteriores, intentos de ingenier\u00eda social y la fuga de informaci\u00f3n, lo que podr\u00eda provocar da\u00f1os a la reputaci\u00f3n, p\u00e9rdida de confianza del cliente e incumplimiento normativo."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}