CVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.
This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The vulnerability is rated with no privileges required and no user interaction required, so an unauthenticated attacker can attempt to enumerate usernames through the self-registration flow.
What is the direct security impact of successful exploitation?
The direct impact is disclosure of whether usernames exist. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.
How could discovered usernames be used by an attacker?
Valid usernames can support subsequent brute-force attempts, social-engineering attacks, and targeted phishing campaigns.