CVE-2025-11850
Received Received - Intake

Improper Implicit Association in WSO2 Identity Server

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WSO2 LLC

Description
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2025-11850
EUVD
EUVD-2025-210627

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wso2 identity_server to 40 (inc)
wso2 identity_server to 132 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in WSO2 Identity Server when secondary user stores are configured. The system incorrectly uses a secondary user store instead of the primary one during identity checks, causing subjects to link to unintended local accounts if duplicate claim values (like usernames or emails) exist across stores. This leads to identity confusion and potential access issues for legitimate users.

Detection Guidance

To detect this vulnerability, check if secondary user stores are configured in WSO2 Identity Server. Review logs for identity association issues or duplicate claim values across stores. No specific commands are provided in the context.

Impact Analysis

If affected, legitimate users might be incorrectly associated with unintended accounts, leading to restricted access if the secondary account has fewer privileges. Identity confusion may also occur when using external Identity Providers, as correct associations fail due to duplicate claims across user stores.

Mitigation Strategies
  • Apply the fix from the GitHub pull request or update to a patched version (WSO2 Identity Server 7.1.0 to version 40 or 7.0.0 to version 132).
  • Modify the deployment.toml file to include the primary user store when secondary stores are present.
  • Disable implicit association if secondary user stores are not required or ensure claim values are globally unique.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart