Threats tagged 'ghsa-g8w9-p6wx-8fxc'

CVE-2025-13736 is an information disclosure vulnerability in WSO2 Identity Server as Key Manager version 5.10.0. When Multi-Attribute Login is enabled, the login interface reveals whether a username exists by displaying the canonical username for valid users and echoing the original input for invalid users. This behavior occurs regardless of the validate_username configuration setting. The vulnerability can aid attackers in enumerating valid usernames, increasing the risk of brute force, social engineering, and phishing attacks.