What is the CVSS score of CVE-2025-13909?

CVE-2025-13909 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-13909?

Yes, a patch is available for CVE-2025-13909. Update the affected software to the latest version immediately.

WSO2 Identity Server CVE-2025-13909

EUVD-2025-210630 MEDIUM

Information Exposure (CWE-200)

2026-08-06 WSO2

GHSA-c5g7-4966-ghvv

Information Disclosure Authentication Bypass Wso2 Identity Server Wso2 Carbon Identity Application Authentication Framework Wso2 Carbon Magiclink Authenticator Module Wso2 Carbon Abstract Otp Authenticator Email Otp Authenticator

4.3

CVSS 3.1 · Vendor: WSO2

Severity by source

Vendor (WSO2) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable authentication flow; PR:L because any tenant account required; only partial PII exposed so C:L; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WSO2).

CVSS VectorVendor: WSO2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 09:01 EUVD

Analysis Generated

Aug 06, 2026 - 08:36 vuln.today

DescriptionCVE.org

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information.

Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.

AnalysisAI

Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.

Technical ContextAI

WSO2 Identity Server is an enterprise identity and access management (IAM) platform supporting multi-tenancy, where distinct organizational units share a single platform instance with strict data separation. The vulnerability resides across multiple components: the core Identity Application Authentication Framework (cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework), the Magic Link Authenticator Module (cpe:2.3:a:wso2:wso2_carbon_magiclink_authenticator_module), the Abstract OTP Authenticator base (cpe:2.3:a:wso2:wso2_carbon_abstract_otp_authenticator), and the Email OTP Authenticator (cpe:2.3:a:wso2:email_otp_authenticator). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: during OTP challenge or Magic Link flows, user lookup or authentication challenge validation queries fail to scope resolution to the originating tenant context, allowing cross-tenant data retrieval. This is an access control gap at the authentication framework layer rather than a protocol flaw in OTP or Magic Link themselves.

RemediationAI

Apply the patch specified in WSO2 Security Advisory WSO2-2025-4731, available at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4731/. The exact patched version number is not independently confirmed from the available input data - consult the advisory directly to identify the correct target release for your installed version of WSO2 Identity Server and its component modules. As a compensating control prior to patching in multi-tenant environments, disable Email OTP, SMS OTP, and Magic Link as first-factor authenticators and substitute with credential-based authenticators (username/password) not affected by this tenant isolation gap; note this trade-off reduces authentication usability and eliminates passwordless flows for users. Additionally, restrict network access to the WSO2 Identity Server endpoints to trusted IP ranges and audit tenant configuration to minimize the user population exposed through shared infrastructure.