The vulnerability in WSO2 Identity Server (CVE-2025-13909) arises from inadequate validation of authentication requests that use Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This flaw causes a failure to enforce tenant isolation, allowing an attacker with some privileges to access PII of users belonging to other tenants. The exposure of such data constitutes a privacy violation and may lead to regulatory non-compliance. The CVSS v3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, required privileges, no user interaction, and limited confidentiality impact. The affected versions explicitly identified are 7.0.0 and 7.1.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, violating privacy and potentially breaching regulatory requirements. The impact is limited to confidentiality loss; integrity and availability are not affected. The exposed data may include sensitive user details such as mobile phone numbers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access privileges to limit exposure and monitor for suspicious activity related to tenant authentication flows. No official remediation or temporary fix is currently documented.