CVE-2025-13909mediumCWE-20CWE-200

CVE-2025-13909: falha de média gravidade em WSO2 Identity Server

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Publicada em

Seguir esta CVE+ Monitorar WSO2 Identity Server+ Monitorar WSO2 Carbon Identity Application Authentication Framework

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
WSO2 · Email OTP AuthenticatorWSO2 · WSO2 Carbon Abstract OTP AuthenticatorWSO2 · WSO2 Carbon Identity Application Authentication FrameworkWSO2 · WSO2 Carbon MagicLink Authenticator ModuleWSO2 · WSO2 Identity Server
CVEs relacionadas — WSO2 Identity Server

No mesmo produto, das mais perigosas para as menos.

CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%CVE-2023-6837HIGHIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationEPSS 0.5%CVE-2024-4412LOWExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsEPSS 0.4%CVE-2025-5802MEDIUMUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2025-13591MEDIUMUsername Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%