CVE-2025-13591

{
  "id": "CVE-2025-13591",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2026-10-19T17:16:59.413",
  "lastModified": "2026-11-04T20:10:00.263",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.\n\nSuccessful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns."
    },
    {
      "lang": "es",
      "value": "El endpoint de autenticación de WSO2 Identity Server no proporciona una respuesta del sistema consistente cuando un nombre de usuario no existe en el sistema, lo que permite a los atacantes diferenciar entre nombres de usuario válidos e inválidos. Esta diferencia en las respuestas puede aprovecharse para enumerar cuentas de usuario existentes.\\n\\nLa explotación exitosa permite a un atacante descubrir nombres de usuario válidos dentro del sistema, incrementando significativamente el riesgo de ataques posteriores, como ataques de fuerza bruta contra credenciales de usuario, ataques de ingeniería social y filtración de información. Los nombres de usuario descubiertos pueden usarse para crear correos electrónicos de phishing dirigidos u otras campañas de ingeniería social."
    }
  ],
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "7.0.0",
              "lessThan": "7.0.0.134",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "lessThan": "7.1.0.42",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "WSO2",
          "product": "WSO2 Carbon Abstract OTP Authenticator",
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core",
          "versions": [
            {
              "version": "1.0.5",
              "lessThan": "1.0.5.3",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "1.0.10",
              "lessThan": "1.0.10.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "WSO2",
          "product": "Email OTP Authenticator",
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp",
          "versions": [
            {
              "version": "1.0.18",
              "lessThan": "1.0.18.8",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "1.0.30",
              "lessThan": "1.0.30.5",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-20T19:31:55.443304Z",
          "id": "CVE-2025-13591",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4583/",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ]
}