CVE-2025-13909: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in WSO2 WSO2 Identity Server
CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.
AI Analysis
Technical Summary
The vulnerability CVE-2025-13909 in WSO2 Identity Server arises from inadequate validation of authentication requests when using first-factor authenticators like Email OTP, SMS OTP, or Magic Link. This failure to enforce tenant isolation allows an attacker with some privileges to access PII belonging to users in other tenants. The exposure of such data constitutes a privacy violation and may lead to regulatory non-compliance. The CVSS score is 4.3 (medium severity), indicating limited confidentiality impact without integrity or availability effects. Affected versions explicitly include 7.0.0 and 7.1.0. No vendor advisory or patch information is currently available.
Potential Impact
Successful exploitation allows an attacker to disclose personally identifiable information of users across different tenants, violating privacy and potentially breaching regulatory requirements. The impact is limited to confidentiality loss without affecting integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review tenant isolation configurations and monitor for unauthorized access attempts related to Email OTP, SMS OTP, or Magic Link authentication mechanisms.
CVE-2025-13909: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in WSO2 WSO2 Identity Server
Description
CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.
CVSS v3.1
Score 4.3medium
Affected software
WSO2
WSO2 Identity Server
WSO2
WSO2 Carbon Identity Application Authentication Framework
WSO2
WSO2 Carbon MagicLink Authenticator Module
WSO2
WSO2 Carbon Abstract OTP Authenticator
WSO2
Email OTP Authenticator
pkg:maven/org.wso2.identityserver/wso2-isRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-13909 in WSO2 Identity Server arises from inadequate validation of authentication requests when using first-factor authenticators like Email OTP, SMS OTP, or Magic Link. This failure to enforce tenant isolation allows an attacker with some privileges to access PII belonging to users in other tenants. The exposure of such data constitutes a privacy violation and may lead to regulatory non-compliance. The CVSS score is 4.3 (medium severity), indicating limited confidentiality impact without integrity or availability effects. Affected versions explicitly include 7.0.0 and 7.1.0. No vendor advisory or patch information is currently available.
Potential Impact
Successful exploitation allows an attacker to disclose personally identifiable information of users across different tenants, violating privacy and potentially breaching regulatory requirements. The impact is limited to confidentiality loss without affecting integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review tenant isolation configurations and monitor for unauthorized access attempts related to Email OTP, SMS OTP, or Magic Link authentication mechanisms.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WSO2
- Date Reserved
- 2025-12-02T16:51:30.837Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7441c2bf8831d53967ebb8
Added to database: 08/06/2026, 08:11:46 UTC
Last enriched: 08/13/2026, 17:33:23 UTC
Last updated: 09/21/2026, 22:01:28 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.