CVE-2025-13591

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/

Configurations

No configuration.

History

19 Oct 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-19 17:16

Updated : 2026-10-20 20:17

NVD link : CVE-2025-13591

Mitre link : CVE-2025-13591

CVE.ORG link : CVE-2025-13591

JSON object : View

Products Affected

No product.

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2025-13591", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13591", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T19:31:55.443304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "7.0.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.134", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.42", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Abstract OTP Authenticator", "versions": [{"status": "affected", "version": "1.0.5", "lessThan": "1.0.5.3", "versionType": "custom"}, {"status": "affected", "version": "1.0.10", "lessThan": "1.0.10.2", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "Email OTP Authenticator", "versions": [{"status": "affected", "version": "1.0.18", "lessThan": "1.0.18.8", "versionType": "custom"}, {"status": "affected", "version": "1.0.30", "lessThan": "1.0.30.5", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp", "defaultStatus": "unknown"}]}], "published": "2026-10-19T17:16:59.413", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns."}], "lastModified": "2026-10-20T20:17:10.607", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}