CVE-2025-13909mediumCWE-20CWE-200

CVE-2025-13909: medium-severity vulnerability in WSO2 Identity Server

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Published

Follow this CVE+ Monitor WSO2 Identity Server+ Monitor WSO2 Carbon Identity Application Authentication Framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
WSO2 · Email OTP AuthenticatorWSO2 · WSO2 Carbon Abstract OTP AuthenticatorWSO2 · WSO2 Carbon Identity Application Authentication FrameworkWSO2 · WSO2 Carbon MagicLink Authenticator ModuleWSO2 · WSO2 Identity Server
Related CVEs — WSO2 Identity Server

In the same product, most dangerous first.

CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%CVE-2023-6837HIGHIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationEPSS 0.5%CVE-2024-4412LOWExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsEPSS 0.4%CVE-2025-5802MEDIUMUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2025-13591MEDIUMUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%