Wso2 Carbon Identity Application Authentication Framework
Monthly
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.