Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2025-13166

Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

CVSS 3.1 3.7 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2025-13166

Published

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-13166

Published

WSO2 Identity Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "WSO2",
                    "product": "WSO2 Identity Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "7.1.0",
                            "lessThan": "7.1.0.40",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "7.2.0",
                            "lessThan": "7.2.0.2",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON