3 results · Clear filters · Feed
-
Medium 5.3
Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be levera…
-
Medium 4.3
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exp…
-
Medium 5.3
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engine…