Threats affecting pkg:maven/org.wso2.identityserver/wso2-is

CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.

CVE-2025-14779 is a vulnerability in WSO2 Identity Server's Secret Type Management REST API where the deletion of a secret type does not properly enforce organizational boundaries. This flaw allows the deletion cascade to remove secrets across all organizations, not just the intended one. Exploitation requires delete permissions on the Secret Type Management REST API, which are typically restricted to administrators. The vulnerability can lead to unintended secret deletions, causing configuration failures, service interruptions, and denial-of-service conditions. The CVSS score is 3.8, indicating a low severity impact.

CVE-2025-11850 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It occurs when secondary user stores are configured, causing the implicit-association resolver to incorrectly initialize from a secondary user store and bypass the primary user store during search and uniqueness checks. This can lead to identity confusion and incorrect implicit associations when using an external Identity Provider (IDP), potentially restricting legitimate user access if the secondary account has fewer privileges. Deployments without secondary user stores, with implicit association disabled, or with globally unique claim values are not affected.

CVE-2025-10908 is a high-severity vulnerability in WSO2 Identity Server versions 6.0.0, 6.1.0, 7.0.0, and 7.1.0. It arises from a lack of user account state validation during authentication, allowing locked user accounts to be authenticated via Magic Link or Pass Key methods.