CVE-2025-13591
Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
- Published
- Updated
- Reserved
- Assigned by
- WSO2
Description
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
- unknown < 7.0.0
- affected 7.0.0 – < 7.0.0.134
- affected 7.1.0 – < 7.1.0.42
WSO2 · WSO2 Carbon Abstract OTP Authenticator
- affected 1.0.5 – < 1.0.5.3
- affected 1.0.10 – < 1.0.10.2
WSO2 · Email OTP Authenticator
- affected 1.0.18 – < 1.0.18.8
- affected 1.0.30 – < 1.0.30.5
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-13591)Record last updated .