CVE-2025-13591: Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts.
Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can query the authentication endpoint and distinguish valid usernames from invalid ones. No user interaction or prior privileges are required.
What is the direct impact of exploitation?
The issue exposes whether specific usernames exist; it does not directly provide credentials or permit account access. Enumerated usernames can make later brute-force or targeted social-engineering attempts more effective.
How can an organization tell whether it may be affected?
Review responses from the WSO2 Identity Server authentication endpoint for valid versus nonexistent usernames. Differing responses indicate that usernames may be enumerable.