Authentication Bypass in WSO2 Products with FIDO Authentication
CVE-2025-0672

3.3LOW

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server As Key Manager
Wso2 Identity Server
Wso2 Open Banking Iam
Vendor
CVE Published:
23 September 2025

What is CVE-2025-0672?

An authentication bypass flaw exists in various WSO2 products with FIDO authentication enabled. When a user account is deleted, its FIDO registration data remains, potentially allowing a new account with the same username to associate with this data. If the deleted user attempts to access the system, they can authenticate using their former FIDO credentials, thereby impersonating the new user account. This vulnerability poses significant security risks for deployments utilizing FIDO authentication.

Affected Version(s)

WSO2 Identity Server 5.10.0 < 5.10.0.345

WSO2 Identity Server 5.11.0 < 5.11.0.394

WSO2 Identity Server as Key Manager 5.10.0 < 5.10.0.338

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-0672 : Authentication Bypass in WSO2 Products with FIDO Authentication