WSO2 Identity Server
CVE-2025-5802
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Registration endpoint is remotely reachable without credentials or interaction; impact limited to username disclosure, so C:L and I/A:N.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
1DescriptionCVE.org
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.
This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.
AnalysisAI
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
Technical ContextAI
This is a classic CWE-203 observable discrepancy: the registration handler branches on whether the supplied username resolves to an existing identity store entry and mirrors that internal state back to the client through distinguishable error text. Because user stores (typically LDAP or JDBC-backed realms) enforce unique usernames, the existence check is unavoidable for correctness - the flaw is in the response, not the lookup. The affected CPE set is broad and shares a common identity core: WSO2 Identity Server, Identity Server as Key Manager, API Manager, API Control Plane, Universal Gateway, Traffic Manager, Open Banking AM/IAM, and the Carbon identity management endpoint util and application authentication framework libraries. The same shared Carbon authentication component is what makes a single advisory span API management and open-banking distributions, so a fix in the identity framework propagates to all listed products.
RemediationAI
Apply the vendor's fixed release for each affected product as documented in WSO2 advisory WSO2-2025-4227 - the available feed does not enumerate exact fix versions, so read the advisory pages for Identity Server, API Manager, and the open-banking distributions before scheduling upgrades, and patch the shared Carbon identity framework components as part of the same change window. Where an immediate upgrade is not possible, the most effective compensating control is to disable or restrict the self-registration flow entirely (in the management console under the user self-registration configuration), which removes the enumeration oracle at the cost of blocking legitimate self-service onboarding; a narrower option is to rate-limit and CAPTCHA-protect the registration endpoint at a reverse proxy, which slows bulk enumeration but does not stop targeted queries. Custom error-message handling that substitutes a generic 'registration could not be completed, check your email' response for the duplicate-username case also mitigates the issue, but this is an application change that must be re-applied after upgrades and may conflict with localization bundles. Network-level allowlisting of the registration endpoint to trusted ranges gives the strongest reduction in exposure if external self-registration is not a business requirement.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today