WSO2 Identity Server CVE-2025-13909

Exploitation requires the WSO2 Identity Server deployment to be operating in multi-tenant mode - single-tenant deployments have no meaningful attack surface because there are no alternate-tenant user records to disclose. At least one of Email OTP, SMS OTP, or Magic Link must be configured as a first-factor authenticator for one or more tenants; if these authenticator types are not enabled, the vulnerable code paths are not invoked. The attacker must hold a valid account (any privilege level) within any tenant on the shared platform (PR:L per CVSS), meaning anonymous or pre-authentication exploitation is not possible. Exploitation is limited by: the requirement for authenticated access, the need for multi-tenant configuration, and the data exposure being constrained to PII fields (e.g., mobile numbers) rather than credentials or full account takeover.

The CVSS 4.3 score reflects a medium-base, information-disclosure-only vulnerability with no integrity or availability impact (C:L/I:N/A:N). The attack vector is network-accessible with low complexity and requires only low-level authentication (PR:L), confirming this is not an unauthenticated flaw - an attacker needs a valid account on the platform in any tenant. No EPSS probability score is present in the available input data, limiting probabilistic exploitation assessment. There is no CISA KEV listing and no known public POC, supporting a classification of no confirmed active exploitation. Real-world risk is highly deployment-context-dependent: organizations running WSO2 Identity Server in single-tenant mode have no meaningful exposure, while multi-tenant SaaS providers or shared enterprise environments face meaningful regulatory risk (GDPR, HIPAA) from cross-tenant PII leakage even at low data volumes. The PR:L barrier reduces opportunistic mass exploitation risk, but compromised low-privilege accounts or malicious insiders represent a realistic threat in targeted attacks against high-value tenant data.

An authenticated low-privilege user holding a valid account within Tenant A initiates an Email OTP or Magic Link authentication challenge and manipulates the request to reference a user identifier associated with Tenant B. Because the authentication framework does not enforce tenant scope during challenge processing or user lookup, the server returns PII - such as a mobile number registered to the Tenant B user - in the response. No public POC is known at time of analysis, but the low attack complexity (AC:L) in the CVSS vector indicates the manipulation would not require specialized tooling beyond standard HTTP request modification.