SCIM Auth Bypass in WSO2 Identity Server Federated User Spoofing
CVE-2025-10149 Published on October 19, 2026
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.
A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.
Vulnerability Analysis
CVE-2025-10149 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Types
Improper Preservation of Permissions
The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Products Associated with CVE-2025-10149
Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.
Affected Versions
WSO2 Identity Server as Key Manager:- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.370 is affected.
- Before 2.0.0 is unknown.
- Version 2.0.0 and below 2.0.0.419 is affected.
- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.379 is affected.
- Version 5.11.0 and below 5.11.0.415 is affected.
- Version 6.0.0 and below 6.0.0.251 is affected.
- Version 6.1.0 and below 6.1.0.251 is affected.
- Version 7.0.0 and below 7.0.0.127 is affected.
- Version 7.1.0 and below 7.1.0.34 is affected.
- Version 5.6.0 and below 5.6.0.1 is affected.
- Version 5.6.1 and below 5.6.1.2 is affected.
- Version 5.7.0 and below 5.7.0.3 is affected.
- Version 5.7.1 and below 5.7.1.1 is affected.
- Version 5.7.7 and below 5.7.7.1 is affected.
- Version 5.7.8 and below 5.7.8.1 is affected.
- Version 1.5.1 and below 1.5.1.40 is affected.
- Version 1.5.46 and below 1.5.46.47 is affected.