CVE-2025-1396
BaseFortify
Publication date: 2025-09-26
Last updated on: 2025-10-06
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | identity_server | 5.10.0 |
| wso2 | identity_server | 5.11.0 |
| wso2 | identity_server | 6.0.0 |
| wso2 | identity_server | 6.1.0 |
| wso2 | identity_server_as_key_manager | 5.10.0 |
| wso2 | open_banking_iam | 2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-203 | The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a username enumeration issue in multiple WSO2 products when Multi-Attribute Login is enabled. The system returns a distinct "User does not exist" error message on the login form, regardless of the validate_username setting. This allows attackers to determine which usernames exist in the system by observing differences in the application's responses.
How can this vulnerability impact me? :
Exploitation of this vulnerability can help attackers confirm valid usernames in the system, which can then be used to facilitate brute-force attacks, targeted phishing campaigns, or other social engineering techniques.