WSO2 Identity Server CVE-2025-5802

Exploitation requires the WSO2 self-registration (sign-up) flow to be enabled and reachable by the attacker, and it requires the attacker to know or guess the username format used by the target's user store, since only strings that match an existing account produce the distinctive duplicate-username error. It is fully unauthenticated and requires no user interaction (CVSS PR:N/UI:N), and no special privileges, configuration file access, or local access are needed. Limits on impact: only account existence is disclosed - no password, token, or attribute data is leaked; the flaw yields no write or execution capability; and effectiveness drops sharply if the endpoint is behind rate limiting, CAPTCHA, IP allowlisting, or a generic-error message handler. Products that ship the identity framework but do not expose a self-registration UI are affected at the library level but not remotely enumerable in practice.

The signals here are consistent and modest: CVSS 3.1 scores 5.3 on AV:N/AC:L/PR:N/UI:N with S:U and only C:L - meaning anyone with network reach to the registration endpoint can query it without credentials or user interaction, but the payoff is limited to a yes/no answer about account existence. That maps cleanly to SSVC-style reasoning: exploitation is not automatable in the sense of yielding code execution, technical impact is partial (information only), and there is no KEV listing, no stated EPSS score, and no public exploit code reported. The practical risk is therefore downstream and cumulative rather than immediate - enumerated usernames materially reduce the search space for password spraying against the same portal, and even a mid-sized municipal IT team in gniezno should treat this as urgent only if their WSO2 deployment exposes self-registration to the internet, which is the real gating question. Important caveats: no EPSS value or KEV status was supplied, so the absence of active-exploitation evidence is an absence of data rather than a positive confirmation, and the CVSS vector confirms unauthenticated remote access (PR:N/UI:N) while the description alone would be ambiguous about reachability.

An attacker with network access to the public registration page scripts a list of candidate usernames against the endpoint and parses the response text, flagging every input that triggers the 'username already in use' error as a confirmed account. The resulting roster is then used for password spraying against the same or federated login portal, or for convincingly personalised phishing and social-engineering messages directed at named employees. The attack needs no credentials, no user interaction, and no exploitation tooling beyond a simple HTTP client, and low request rates make it difficult to distinguish from ordinary registration traffic.