WSO2 Identity Server Username Enumeration via Auth Response
CVE-2025-13591 Published on October 19, 2026

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-13591 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is a Side Channel Attack Vulnerability?

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.

CVE-2025-13591 has been classified to as a Side Channel Attack vulnerability or weakness.


Products Associated with CVE-2025-13591

Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.

Wso2 Identity Server
 
Wso2 Carbon Abstract Otp Authenticator
 
Wso2 Email Otp Authenticator
 

Affected Versions

WSO2 Identity Server: WSO2 Carbon Abstract OTP Authenticator: WSO2 Email OTP Authenticator: