Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-5802

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.354affected
  • 3.2.0 to < 3.2.0.458affected
  • 3.2.0 to < 3.2.0.478affected
  • 3.2.1 to < 3.2.1.96affected
  • 4.0.0 to < 4.0.0.379affected
  • 4.1.0 to < 4.1.0.262affected
  • 4.2.0 to < 4.2.0.200affected
  • 4.3.0 to < 4.3.0.112affected
  • 4.4.0 to < 4.4.0.72affected
  • 4.5.0 to < 4.5.0.55affected
  • 4.6.0 to < 4.6.0.17affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.56affected
  • 4.6.0 to < 4.6.0.18affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.55affected
  • 4.6.0 to < 4.6.0.17affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.54affected
  • 4.6.0 to < 4.6.0.17affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.383affected
  • 5.11.0 to < 5.11.0.430affected
  • 6.0.0 to < 6.0.0.257affected
  • 6.1.0 to < 6.1.0.234affected
  • 6.1.0 to < 6.1.0.257affected
  • 7.0.0 to < 7.0.0.133affected
  • 7.1.0 to < 7.1.0.41affected
  • 7.2.0 to < 7.2.0.3affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.374affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.403affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.423affected

WSO2 WSO2 Carbon Identity Management Endpoint Util

Default version status: unknown

  • 5.17.5 to < 5.17.5.332affected
  • 5.18.187 to < 5.18.187.330affected
  • 5.23.8 to < 5.23.8.213affected
  • 5.25.92 to < 5.25.92.167affected
  • 7.0.78 to < 7.0.78.162affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Identity Application Authentication Framework

Default version status: unknown

  • 5.17.5 to < 5.17.5.332affected
  • 5.18.187 to < 5.18.187.330affected
  • x to ≤ *unaffected

References