Riskcovery

CVE-2025-5802

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

State
Published
Severity
5.3 Medium
Published
Sep 15, 2026
Updated
Sep 15, 2026
Reserved
Jun 6, 2025

Read the record on cve.org

Description

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.

This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWSO2

Weaknesses

  • CWE-203 Information Disclosure Through Error Messages

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.354Affected
  • 3.2.0 to before 3.2.0.458Affected
  • 3.2.0 to before 3.2.0.478Affected
  • 3.2.1 to before 3.2.1.96Affected
  • 4.0.0 to before 4.0.0.379Affected
  • 4.1.0 to before 4.1.0.262Affected
  • 4.2.0 to before 4.2.0.200Affected
  • 4.3.0 to before 4.3.0.112Affected
  • 4.4.0 to before 4.4.0.72Affected
  • 4.5.0 to before 4.5.0.55Affected
  • 4.6.0 to before 4.6.0.17Affected
WSO2 API Control PlaneWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.56Affected
  • 4.6.0 to before 4.6.0.18Affected
WSO2 Universal GatewayWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.55Affected
  • 4.6.0 to before 4.6.0.17Affected
WSO2 Traffic ManagerWSO2
  • before 4.5.0Unknown
  • 4.5.0 to before 4.5.0.54Affected
  • 4.6.0 to before 4.6.0.17Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.383Affected
  • 5.11.0 to before 5.11.0.430Affected
  • 6.0.0 to before 6.0.0.257Affected
  • 6.1.0 to before 6.1.0.234Affected
  • 6.1.0 to before 6.1.0.257Affected
  • 7.0.0 to before 7.0.0.133Affected
  • 7.1.0 to before 7.1.0.41Affected
  • 7.2.0 to before 7.2.0.3Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.374Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.403Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.423Affected
WSO2 Carbon Identity Management Endpoint UtilWSO2
  • 5.17.5 to before 5.17.5.332Affected
  • 5.18.187 to before 5.18.187.330Affected
  • 5.23.8 to before 5.23.8.213Affected
  • 5.25.92 to before 5.25.92.167Affected
  • 7.0.78 to before 7.0.78.162Affected
  • x and laterNot affected
WSO2 Carbon Identity Application Authentication FrameworkWSO2
  • 5.17.5 to before 5.17.5.332Affected
  • 5.18.187 to before 5.18.187.330Affected
  • x and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.