CVE-2025-11850 Auth bypass in Token Exchange Grant Type For OAuth
Attackers can exploit identity confusion in WSO2 Identity Server to associate external accounts with unintended local users, potentially gaining unauthorized access or privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-11850?
CVE-2025-11850 is a medium-severity authentication bypass vulnerability in Wso2 Identity Server, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store.
If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.
Weakness: CWE-639
Which versions are affected by CVE-2025-11850?
It affects 1 product.
Products include Wso2 Identity Server.
How do I fix CVE-2025-11850?
No fix has been published for CVE-2025-11850 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-11850 being exploited?
There is no known exploitation of CVE-2025-11850 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Identity Server
- CVE-2016-4311 Cross-site request forgery in n/a
- CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
- CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2016-4312 XML external entity in n/a
- CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
Sources
Also known as GHSA-25wv-6jh5-5g7f.