Wso2 Identity Server
CVE-2025-13166
LOW
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (WSO2) · only source for this CVE.
CVSS VectorVendor: WSO2
Lifecycle Timeline
1DescriptionCVE.org
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.
This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.
AnalysisAI
WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise.
More in Wso2 Identity Server
View allAuthentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated att
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Modul
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentica
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are n
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segrega
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today