CVE-2025-13736
Received Received - Intake

Information Disclosure in Multi-Attribute Login System

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WSO2 LLC

Description
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information to craft more effective phishing campaigns or social engineering tactics to compromise user accounts or extract sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2025-13736
EUVD
EUVD-2025-210626

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wso2 api_manager *
wso2 identity_server *
wso2 open_banking *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when Multi-Attribute Login is enabled in WSO2 products. The login interface inconsistently masks user account existence. For valid users, it shows their actual username, while for invalid users, it repeats the input. This allows attackers to determine if a username exists, enabling further attacks.

Detection Guidance

To detect this vulnerability, test the login interface with a list of potential usernames. Observe if the system responds differently for valid vs invalid accounts. For example, valid accounts may show the canonical username while invalid ones echo the input.

Impact Analysis

Attackers can exploit this to identify valid usernames, increasing risks of brute force attacks, social engineering, and targeted phishing. They may use this information to craft more convincing attacks to compromise accounts or steal sensitive data.

Mitigation Strategies

Apply the latest patches provided by WSO2 for affected products. Update to the latest unaffected versions of WSO2 API Manager, Identity Server, or Open Banking components. Disable Multi-Attribute Login if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart