This vulnerability involves inconsistent masking of user existence during login in WSO2 Identity Server as Key Manager 5.10.0 when Multi-Attribute Login is enabled. The login interface differentiates valid from invalid usernames by returning the canonical username for valid accounts and the original input for invalid ones, independent of the validate_username configuration. This information disclosure (CWE-203) can facilitate username enumeration, which attackers may use to enhance brute force or social engineering attacks.

The vulnerability allows attackers to confirm valid usernames by observing the login interface responses. This information disclosure can increase the likelihood of successful brute force attacks, targeted phishing campaigns, and social engineering attacks aimed at compromising user accounts or extracting sensitive information. The CVSS score is 3.7 (low severity), indicating limited confidentiality impact without direct integrity or availability effects.

No official patch or remediation level has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider disabling Multi-Attribute Login if feasible or implementing additional monitoring and rate limiting to reduce the risk of username enumeration attacks.