CVE-2025-1396
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-26

Last updated on: 2025-10-06

Assigner: WSO2 LLC

Description
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses. Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-26
Last Modified
2025-10-06
Generated
2026-05-07
AI Q&A
2025-09-26
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
wso2 identity_server 5.10.0
wso2 identity_server 5.11.0
wso2 identity_server 6.0.0
wso2 identity_server 6.1.0
wso2 identity_server_as_key_manager 5.10.0
wso2 open_banking_iam 2.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a username enumeration issue in multiple WSO2 products when Multi-Attribute Login is enabled. The system returns a distinct "User does not exist" error message on the login form, regardless of the validate_username setting. This allows attackers to determine which usernames exist in the system by observing differences in the application's responses.


How can this vulnerability impact me? :

Exploitation of this vulnerability can help attackers confirm valid usernames in the system, which can then be used to facilitate brute-force attacks, targeted phishing campaigns, or other social engineering techniques.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart