Username Exposure Vulnerability in WSO2 Product
CVE-2025-5802

5.3MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Api Control Plane
Wso2 Universal Gateway
Wso2 Traffic Manager
Vendor
CVE Published:
15 September 2026

What is CVE-2025-5802?

The self-registration process in WSO2 Identity Server inadequately handles user input for usernames, allowing attackers to determine the existence of usernames through explicit error messages. When a registration attempt is made with an already used username, the system reveals that the username is taken. This vulnerability can lead to unauthorized username discovery, potentially leading to further security threats, such as brute force attacks and phishing attempts.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.56

WSO2 API Control Plane 4.6.0 < 4.6.0.18

WSO2 API Manager 3.1.0 < 3.1.0.354

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.