CVE-2025-13591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13591", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-11-24T05:16:09.553Z", "datePublished": "2026-10-19T16:45:59.519Z", "dateUpdated": "2026-10-20T19:32:03.360Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-19T16:45:59.519Z"}, "title": "Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-203", "description": "CWE-203: Information Exposure Through Discrepancy", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-274", "descriptions": [{"lang": "en", "value": "CAPEC-274 CAPEC-274: Username Enumeration"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "7.0.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.134", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.42", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Abstract OTP Authenticator", "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core", "versions": [{"status": "affected", "version": "1.0.5", "lessThan": "1.0.5.3", "versionType": "custom"}, {"status": "affected", "version": "1.0.10", "lessThan": "1.0.10.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "Email OTP Authenticator", "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp", "versions": [{"status": "affected", "version": "1.0.18", "lessThan": "1.0.18.8", "versionType": "custom"}, {"status": "affected", "version": "1.0.30", "lessThan": "1.0.30.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.134"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.1.0.42"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_abstract_otp_authenticator:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.5", "versionEndExcluding": "1.0.5.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_abstract_otp_authenticator:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.10", "versionEndExcluding": "1.0.10.2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:email_otp_authenticator:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.18", "versionEndExcluding": "1.0.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:email_otp_authenticator:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.30", "versionEndExcluding": "1.0.30.5"}]}]}], "descriptions": [{"lang": "en", "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4583", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T19:31:55.443304Z", "id": "CVE-2025-13591", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T19:32:03.360Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13591", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T19:31:55.443304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T19:31:59.961Z"}}], "cna": {"title": "Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery", "source": {"advisory": "WSO2-2025-4583", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-274", "descriptions": [{"lang": "en", "value": "CAPEC-274 CAPEC-274: Username Enumeration"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "7.0.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.134", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.42", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Abstract OTP Authenticator", "versions": [{"status": "affected", "version": "1.0.5", "lessThan": "1.0.5.3", "versionType": "custom"}, {"status": "affected", "version": "1.0.10", "lessThan": "1.0.10.2", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "Email OTP Authenticator", "versions": [{"status": "affected", "version": "1.0.18", "lessThan": "1.0.18.8", "versionType": "custom"}, {"status": "affected", "version": "1.0.30", "lessThan": "1.0.30.5", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.", "supportingMedia": [{"type": "text/html", "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-203", "description": "CWE-203: Information Exposure Through Discrepancy"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.0.134", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.0.42", "versionStartIncluding": "7.1.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_abstract_otp_authenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.5.3", "versionStartIncluding": "1.0.5"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_abstract_otp_authenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.10.2", "versionStartIncluding": "1.0.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:email_otp_authenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.18.8", "versionStartIncluding": "1.0.18"}, {"criteria": "cpe:2.3:a:wso2:email_otp_authenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.30.5", "versionStartIncluding": "1.0.30"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-19T16:45:59.519Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13591", "state": "PUBLISHED", "dateUpdated": "2026-10-20T19:32:03.360Z", "dateReserved": "2025-11-24T05:16:09.553Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-10-19T16:45:59.519Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "7.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "7.0.0.134", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "7.1.0.42", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core", "product": "WSO2 Carbon Abstract OTP Authenticator", "vendor": "WSO2", "versions": [{"lessThan": "1.0.5.3", "status": "affected", "version": "1.0.5", "versionType": "custom"}, {"lessThan": "1.0.10.2", "status": "affected", "version": "1.0.10", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp", "product": "Email OTP Authenticator", "vendor": "WSO2", "versions": [{"lessThan": "1.0.18.8", "status": "affected", "version": "1.0.18", "versionType": "custom"}, {"lessThan": "1.0.30.5", "status": "affected", "version": "1.0.30", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns."}, {"lang": "es", "value": "El endpoint de autenticaci\u00f3n de WSO2 Identity Server no proporciona una respuesta del sistema consistente cuando un nombre de usuario no existe en el sistema, lo que permite a los atacantes diferenciar entre nombres de usuario v\u00e1lidos e inv\u00e1lidos. Esta diferencia en las respuestas puede aprovecharse para enumerar cuentas de usuario existentes.\\n\\nLa explotaci\u00f3n exitosa permite a un atacante descubrir nombres de usuario v\u00e1lidos dentro del sistema, incrementando significativamente el riesgo de ataques posteriores, como ataques de fuerza bruta contra credenciales de usuario, ataques de ingenier\u00eda social y filtraci\u00f3n de informaci\u00f3n. Los nombres de usuario descubiertos pueden usarse para crear correos electr\u00f3nicos de phishing dirigidos u otras campa\u00f1as de ingenier\u00eda social."}], "id": "CVE-2025-13591", "lastModified": "2026-11-04T20:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13591", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T19:31:55.443304Z", "version": "2.0.3"}}]}, "published": "2026-10-19T17:16:59.413", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.18,1.0.18.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.30,1.0.30.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Email OTP Authenticator", "source": "cna", "vendor": "WSO2"}, "product": "email_otp_authenticator", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0,7.0.0.134)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1.0,7.1.0.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "identity_server", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.5,1.0.5.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.10,1.0.10.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Abstract OTP Authenticator", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_abstract_otp_authenticator", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0,7.0.0.134)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1.0,7.1.0.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "wso2_identity_server", "vendor": "wso2"}], "created": "2026-10-19T18:30:02.316256+00:00", "updated": "2026-10-19T20:00:04.623266+00:00", "vendors": ["wso2", "wso2$PRODUCT$email_otp_authenticator", "wso2$PRODUCT$identity_server", "wso2$PRODUCT$wso2_carbon_abstract_otp_authenticator", "wso2$PRODUCT$wso2_identity_server"]}