CVE-2025-13591
Received Received - Intake

Username Enumeration in WSO2 Identity Server

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WSO2 LLC

Description
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2025-13591
EUVD
EUVD-2025-211119

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 Identity Server 7.0.0
WSO2 WSO2 Identity Server 7.1.0
WSO2 WSO2 Carbon Abstract OTP Authenticator 1.0.5
WSO2 WSO2 Carbon Abstract OTP Authenticator 1.0.10
WSO2 Email OTP Authenticator 1.0.18
WSO2 Email OTP Authenticator 1.0.30

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-13591 is a username enumeration vulnerability in WSO2 Identity Server's authentication endpoint. It allows attackers to determine if a username exists in the system by observing inconsistent error responses. This occurs because the system behaves differently when a valid username is entered versus an invalid one.

Detection Guidance

To detect this vulnerability, monitor authentication endpoint responses for inconsistencies when testing with valid and invalid usernames. Compare error messages or response times between requests. If responses differ significantly, the system may be vulnerable. Use tools like curl to send test requests and analyze differences.

Impact Analysis

This vulnerability enables attackers to discover valid usernames, increasing risks of brute force attacks, social engineering, credential theft, and information leakage. Discovered usernames can be used for targeted phishing campaigns or other malicious activities against the system.

Compliance Impact

This vulnerability may violate privacy and data protection requirements under GDPR and HIPAA by enabling unauthorized disclosure of valid user accounts. It increases the risk of unauthorized access, which could lead to non-compliance with these regulations.

Mitigation Strategies

Apply the public fixes from GitHub pull requests or update to the latest unaffected versions of WSO2 Identity Server. For community users, update to the latest versions available in the GitHub repositories. WSO2 Support Subscription holders should update to versions 42 (for 7.1.0) or 134 (for 7.0.0). Additionally, modify the deployment.toml file to set `hide_user_existence = true` to fully resolve the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart