ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2025-5802

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown
Original advisory

cve-program · CVE-2025-5802

Published

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-5802

Published

WSO2 API Manager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 API Manager",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "3.1.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "3.1.0.354",
                            "status": "affected",
                            "version": "3.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "3.2.0.458",
                            "status": "affected",
                            "version": "3.2.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "3.2.0.478",
                            "status": "affected",
                            "version": "3.2.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "3.2.1.96",
                            "status": "affected",
                            "version": "3.2.1",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.0.0.379",
                            "status": "affected",
                            "version": "4.0.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.1.0.262",
                            "status": "affected",
                            "version": "4.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.2.0.200",
                            "status": "affected",
                            "version": "4.2.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.3.0.112",
                            "status": "affected",
                            "version": "4.3.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.4.0.72",
                            "status": "affected",
                            "version": "4.4.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.5.0.55",
                            "status": "affected",
                            "version": "4.5.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.6.0.17",
                            "status": "affected",
                            "version": "4.6.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 API Control Plane

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 API Control Plane",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "4.5.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.5.0.56",
                            "status": "affected",
                            "version": "4.5.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.6.0.18",
                            "status": "affected",
                            "version": "4.6.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Universal Gateway

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Universal Gateway",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "4.5.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.5.0.55",
                            "status": "affected",
                            "version": "4.5.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.6.0.17",
                            "status": "affected",
                            "version": "4.6.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Traffic Manager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Traffic Manager",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "4.5.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.5.0.54",
                            "status": "affected",
                            "version": "4.5.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.6.0.17",
                            "status": "affected",
                            "version": "4.6.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Identity Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Identity Server",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "5.10.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.10.0.383",
                            "status": "affected",
                            "version": "5.10.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.11.0.430",
                            "status": "affected",
                            "version": "5.11.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "6.0.0.257",
                            "status": "affected",
                            "version": "6.0.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "6.1.0.234",
                            "status": "affected",
                            "version": "6.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "6.1.0.257",
                            "status": "affected",
                            "version": "6.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "7.0.0.133",
                            "status": "affected",
                            "version": "7.0.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "7.1.0.41",
                            "status": "affected",
                            "version": "7.1.0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "7.2.0.3",
                            "status": "affected",
                            "version": "7.2.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Identity Server as Key Manager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Identity Server as Key Manager",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "5.10.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.10.0.374",
                            "status": "affected",
                            "version": "5.10.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Open Banking AM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Open Banking AM",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "2.0.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "2.0.0.403",
                            "status": "affected",
                            "version": "2.0.0",
                            "versionType": "custom"
                        }
                    ]
                }

WSO2 Open Banking IAM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "WSO2 Open Banking IAM",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "2.0.0",
                            "status": "unknown",
                            "version": "0",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "2.0.0.423",
                            "status": "affected",
                            "version": "2.0.0",
                            "versionType": "custom"
                        }
                    ]
                }

org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unknown",
                    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util",
                    "product": "WSO2 Carbon Identity Management Endpoint Util",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "5.17.5.332",
                            "status": "affected",
                            "version": "5.17.5",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.18.187.330",
                            "status": "affected",
                            "version": "5.18.187",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.23.8.213",
                            "status": "affected",
                            "version": "5.23.8",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.25.92.167",
                            "status": "affected",
                            "version": "5.25.92",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "7.0.78.162",
                            "status": "affected",
                            "version": "7.0.78",
                            "versionType": "custom"
                        },
                        {
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "version": "x",
                            "versionType": "custom"
                        }
                    ]
                }

org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unknown",
                    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
                    "product": "WSO2 Carbon Identity Application Authentication Framework",
                    "vendor": "WSO2",
                    "versions": [
                        {
                            "lessThan": "5.17.5.332",
                            "status": "affected",
                            "version": "5.17.5",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "5.18.187.330",
                            "status": "affected",
                            "version": "5.18.187",
                            "versionType": "custom"
                        },
                        {
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "version": "x",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 14:14 UTC · 274 of 275 readable · 273 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.