CVE-2025-1396 Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled
Attackers can enumerate valid usernames in WSO2 products when Multi-Attribute Login is enabled, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1396?
CVE-2025-1396 is a low-severity vulnerability in Wso2 Identity Server, published on 26 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses.
Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.
Weakness: CWE-203
Which versions are affected by CVE-2025-1396?
2 open source packages ship an affected version, including org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt Maven | All versions to 7.8.103 | None |
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt Maven | All versions to 7.8.103 | None |
Products include Wso2 Identity Server, Wso2 Identity Server as Key Manager, Wso2 Open Banking Iam.
How do I fix CVE-2025-1396?
Apply the vendor's patch.
Is CVE-2025-1396 being exploited?
There is no known exploitation of CVE-2025-1396 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Identity Server
- CVE-2016-4311 Cross-site request forgery in n/a
- CVE-2025-10470 Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
- CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
- CVE-2016-4312 XML external entity in n/a
- CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
Sources
Also known as CLEANSTART-2026-WA25182, GHSA-w82p-r9vw-4rg5.