PT-2025-39521 · Wso2 · Wso2 Products

Published 2025-09-26 · Updated 2025-10-06 · CVE-2025-1396

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description A username enumeration issue exists when Multi-Attribute Login is enabled. The system provides a different response for existing and non-existing usernames, regardless of the validate username setting. This allows attackers to determine valid usernames, potentially aiding in brute-force attacks, phishing, or social engineering. The API endpoint involved is the login form. The username parameter is vulnerable to enumeration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2025-1396

GHSA-W82P-R9VW-4RG5

Affected Products

Wso2 Products

References · 10

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1396 · Security Note
• https://osv.dev/vulnerability/GHSA-w82p-r9vw-4rg5 · Vendor Advisory
• https://github.com/wso2/carbon-identity-framework · Note
• https://github.com/wso2/carbon-identity-framework/commit/5d5d592882a0377c12e19967c6272ccce0fb18ab · Note
• https://t.me/cveNotify/137495 · Telegram Post
• https://t.me/cveNotify/136507 · Telegram Post
• https://t.me/cveNotify/136509 · Telegram Post
• https://twitter.com/CVEnew/status/1971539554344575163 · Twitter Post