CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
Attackers can expose personally identifiable information across tenants due to insufficient validation in multi-tenant authentication flows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13909?
CVE-2025-13909 is a medium-severity vulnerability in Wso2 Identity Server, published on 6 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information.
Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.
Which versions are affected by CVE-2025-13909?
It affects 1 product.
Products include Wso2 Identity Server.
How do I fix CVE-2025-13909?
No fix has been published for CVE-2025-13909 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13909 being exploited?
There is no known exploitation of CVE-2025-13909 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Identity Server
- CVE-2016-4311 Cross-site request forgery in n/a
- CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
- CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2016-4312 XML external entity in n/a
- CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
Sources
Also known as GHSA-c5g7-4966-ghvv.