CVE-2025-13909

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Improper Input Validation pada wso2 identity server. Skor CVSS 3.1 4.3 (Medium) menurut CNA.

Deskripsi (NVD)

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4731/ advisory vendor