CVE-2025-13909mediumCWE-20CWE-200

CVE-2025-13909: fallo de gravedad media en WSO2 Identity Server

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Publicada el

Seguir esta CVE+ Monitorear WSO2 Identity Server+ Monitorear WSO2 Carbon Identity Application Authentication Framework

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.3%
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WSO2 · Email OTP AuthenticatorWSO2 · WSO2 Carbon Abstract OTP AuthenticatorWSO2 · WSO2 Carbon Identity Application Authentication FrameworkWSO2 · WSO2 Carbon MagicLink Authenticator ModuleWSO2 · WSO2 Identity Server
CVEs relacionadas — WSO2 Identity Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%CVE-2023-6837HIGHIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationEPSS 0.5%CVE-2024-4412LOWExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsEPSS 0.4%CVE-2025-5802MEDIUMUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2025-13591MEDIUMUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%