The vulnerability in WSO2 Identity Server arises from improper handling of implicit associations when secondary user stores are configured. The implicit-association resolver incorrectly initializes from a secondary user store, bypassing the primary user store during search and uniqueness checks. This flaw allows a subject to be associated with an unintended local account if the same lookup claim (such as username or email) exists in both primary and secondary stores. This can cause identity confusion and incorrect associations with external Identity Provider accounts, potentially restricting access if the secondary account has fewer privileges. The issue does not affect deployments without secondary user stores, with implicit association disabled, or where claim values are globally unique.

The vulnerability can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider. Legitimate user accounts in the primary user store may fail to associate correctly with their external IDP accounts, potentially restricting access if the secondary account has fewer privileges. There is no direct confidentiality or integrity impact reported. Availability impact is low. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation includes ensuring no secondary user stores are configured, disabling implicit association, or ensuring claim values are globally unique across user stores. Monitor vendor advisories for official fixes or updates.