CVE-2025-1396

Description

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct User does not exist error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the applications responses.Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.03

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-1396 are affected in WSO2 - org.wso2.carbon.identity.input.validation.mgt 7.8.103	Windows
Vulnerabilities CVE-2025-1396 are affected in WSO2 - org.wso2.carbon.identity.input.validation.mgt for Linux 7.8.103	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234