The vulnerability in WSO2 Identity Server arises from improper initialization of the implicit-association resolver when secondary user stores are configured. This flaw causes the resolver to bypass the primary user store during search and uniqueness checks for lookup claims such as username or email. If duplicate claim values exist across primary and secondary user stores, a subject may be incorrectly associated with a local account from the secondary store rather than the intended primary account. This leads to identity confusion and may prevent legitimate users from correctly associating their external IDP accounts, potentially restricting access if the secondary account has fewer privileges. The issue is specific to versions 7.0.0 and 7.1.0 and does not affect deployments without secondary user stores, with implicit association disabled, or with globally unique claim values.

The vulnerability can cause identity confusion due to incorrect implicit associations between external IDP accounts and local accounts in WSO2 Identity Server. Legitimate users may be denied proper access if their external IDP account associates with a secondary user store account that has fewer privileges. There is no direct confidentiality or integrity impact reported, but availability impact is low. The issue only affects deployments with secondary user stores configured and duplicate claim values across stores.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, deployments can mitigate risk by disabling implicit association, ensuring claim values are globally unique across user stores, or avoiding configuration of secondary user stores. Monitor vendor communications for official fixes or updates.