Riskcovery

CVE-2025-13909

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

State
Published
Severity
4.3 Medium
Published
Aug 6, 2026
Updated
Aug 6, 2026
Reserved
Dec 2, 2025

Read the record on cve.org

Description

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information.

Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NWSO2

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
WSO2 Identity ServerWSO2
  • 7.0.0 to before 7.0.0.134Affected
  • 7.1.0 to before 7.1.0.42Affected
WSO2 Carbon Identity Application Authentication FrameworkWSO2
  • 7.0.78 to before 7.0.78.162Affected
  • 7.8.23 to before 7.8.23.66Affected
  • 7.8.550 and laterNot affected
WSO2 Carbon MagicLink Authenticator ModuleWSO2
  • 1.1.22 to before 1.1.22.6Affected
  • 1.1.31 to before 1.1.31.3Affected
  • 1.1.45 and laterNot affected
WSO2 Carbon Abstract OTP AuthenticatorWSO2
  • 1.0.5 to before 1.0.5.4Affected
  • 1.0.10 to before 1.0.10.1Affected
  • 1.0.24 and laterNot affected
Email OTP AuthenticatorWSO2
  • 1.0.30 to before 1.0.30.4Affected
  • 1.0.51 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.