CVE-2025-13591: WSO2 Identity Server 7.0.0 to before 7.0.0.134, 7.1.0 to before 7.1.0.42; +2 more affected products

Affected technology

WSO2 Identity Server · 7.0.0 to before 7.0.0.134, 7.1.0 to before 7.1.0.42
WSO2

WSO2 Carbon Abstract OTP Authenticator · 1.0.5 to before 1.0.5.3, 1.0.10 to before 1.0.10.2
WSO2

Email OTP Authenticator · 1.0.18 to before 1.0.18.8, 1.0.30 to before 1.0.30.5
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.