Username Enumeration Vulnerability in WSO2 Identity Server
CVE-2025-13591

5.3MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Wso2 Carbon Abstract Otp Authenticator
Email Otp Authenticator
Vendor
CVE Published:
19 October 2026

What is CVE-2025-13591?

The authentication endpoint of WSO2 Identity Server contains a vulnerability where inconsistent responses are returned for valid and invalid usernames. This flaw allows malicious actors to determine which usernames exist within the system, enabling them to launch further attacks. By exploiting this vulnerability, attackers can gather valid usernames, increasing the likelihood of successful brute force attempts, phishing campaigns, and social engineering tactics. The risk is heightened as these identifiable usernames may become the target of further malicious activities.

Affected Version(s)

Email OTP Authenticator 1.0.18 < 1.0.18.8

Email OTP Authenticator 1.0.30 < 1.0.30.5

WSO2 Carbon Abstract OTP Authenticator 1.0.5 < 1.0.5.3

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.