WSO2 Identity Server EUVD-2025-211118

Three concrete prerequisites must coexist: (1) the attacker must be authenticated as a federated user on the WSO2 Identity Server (or Open Banking IAM / Identity Server as Key Manager); (2) a LOCAL user account and the attacker's FEDERATED account must share the SAME username, which the SCIM endpoint fails to disambiguate; and (3) the SCIM 2.0 or SCIM 1.1 user endpoint must be reachable. The decisive limiting/enabling factor is user self-registration: with self-registration enabled an attacker can freely create a federated identity matching a target username (vendor treats this as high severity), whereas deployments that do NOT support self-registration are vendor-rated medium because the attacker must already possess a colliding federated account.

This is a meaningful priority for WSO2 Identity Server operators, but the signals are partly conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it network-reachable, low-complexity, and unauthenticated with high integrity impact (I:H) yielding 8.2, yet the description explicitly states the attacker must be 'authenticated as a federated user' - so PR:N appears to reflect the high-severity scenario where user self-registration is enabled (anyone can obtain a federated identity), not a truly credential-less attack. Verify with WSO2: in deployments WITHOUT self-registration the vendor itself downgrades this to medium, because the attacker must already control a federated account whose username collides with a target local account. No EPSS score, CISA KEV listing, or public PoC was provided, so there is no evidence of active or at-scale exploitation; the realistic risk is targeted account takeover against internet-exposed WSO2 IAM deployments that run SCIM with self-registration, rather than mass opportunistic exploitation. Net: a genuine, patch-worthy authorization flaw (CWE-281) in security-critical identity infrastructure, but exploitation hinges on specific configuration rather than being a universally remote-unauthenticated RCE-class issue.

On a WSO2 Identity Server deployment with user self-registration enabled, an attacker self-registers (or logs in) as a federated user and chooses a username that matches an existing local account. Authenticated with that federated identity, they call the SCIM 2.0 or SCIM 1.1 endpoint, which fails to distinguish the federated principal from the local user of the same name, letting them modify or take over the local account. No public exploit code was identified at time of analysis.