Email Otp Authenticator
Monthly
Username enumeration in WSO2 Identity Server allows unauthenticated remote attackers to distinguish valid accounts from invalid ones by observing inconsistent responses from the authentication endpoint when a supplied username does not exist. The issue affects deployments using the Email OTP Authenticator and WSO2 Carbon Abstract OTP Authenticator, and it is a low-to-moderate severity information-disclosure flaw (CVSS 5.3) rather than a direct path to credential theft, data access, or code execution. No public exploit code was identified at time of analysis, and the practical risk comes from chaining discovered usernames with brute-force, password-spraying, or social-engineering campaigns.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Username enumeration in WSO2 Identity Server allows unauthenticated remote attackers to distinguish valid accounts from invalid ones by observing inconsistent responses from the authentication endpoint when a supplied username does not exist. The issue affects deployments using the Email OTP Authenticator and WSO2 Carbon Abstract OTP Authenticator, and it is a low-to-moderate severity information-disclosure flaw (CVSS 5.3) rather than a direct path to credential theft, data access, or code execution. No public exploit code was identified at time of analysis, and the practical risk comes from chaining discovered usernames with brute-force, password-spraying, or social-engineering campaigns.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.