Security Advisory WSO2-2025-4227/CVE-2025-5802¶

Published: July 04, 2026

Updated: July 04, 2026

Version: 1.0

Severity: Medium

CVSS Score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVE IDs: CVE-2025-5802

AFFECTED PRODUCTS¶

• WSO2 API Control Plane: 4.6.0, 4.5.0
• WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0
• WSO2 Identity Server: 7.2.0, 7.1.0, 7.0.0, 6.1.0, 6.0.0, 5.11.0, 5.10.0
• WSO2 Identity Server as Key Manager: 5.10.0
• WSO2 Open Banking AM: 2.0.0
• WSO2 Open Banking IAM: 2.0.0
• WSO2 Traffic Manager: 4.6.0, 4.5.0
• WSO2 Universal Gateway: 4.6.0, 4.5.0

OVERVIEW¶

Potential username enumeration in self registration flow.

DESCRIPTION¶

In the self-registration flow, attempting to sign up with a username that already exists triggers an error message indicating that the username is in use. This behavior can inadvertently reveal whether a username is registered, leading to username enumeration.

IMPACT¶

The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and information leakage. As an example, attackers can use the list of usernames to craft targeted phishing emails or other social engineering attacks to trick users into divulging sensitive information.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2-extensions/identity-governance/pull/1097
• https://github.com/wso2/product-apim/pull/14023
• https://github.com/wso2/carbon-apimgt/pull/13650

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.

After applying the provided update or public PR to the affected product versions, follow the instructions below to apply the required configurations for the respective product to fully mitigate the identified vulnerability.

WSO2 Identity Server 7.2.0, 7.1.0 and 7.0.0

In the Console, navigate to Login & Registration and uncheck "Display message if username unavailable" with account verification enabled. (This configuration was already available in 7.1.0 upwards and is now extended to cover additional flows.)

WSO2 Identity Server 6.1.0 and 6.0.0

In the Carbon Management Console, navigate to Home > Identity > Identity Providers > Resident > User Onboarding > Self Registration. Uncheck the newly introduced configuration "Display message if username unavailable" with account confirmation enabled.

WSO2 Identity Server 5.11.0

In the Carbon Management Console, navigate to Home > Identity > Identity Providers > Resident > User Onboarding > Self Registration. Uncheck the newly introduced configuration "Display message if username unavailable".

WSO2 Identity Server 5.10.0

In the Carbon Management Console, navigate to Home > Identity > Identity Providers > Resident > Account Management Policies > User Self Registration. Uncheck the newly introduced configuration "Display message if username unavailable" with account confirmation enabled.

WSO2 API Manager 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 and 4.6.0

In the Carbon Management Console, navigate to Main > Home > Identity > Identity Providers > Resident > User Onboarding > Self Registration. Uncheck the newly introduced configuration "Display message if username unavailable" and check “Send sign up confirmation email” and “Lock user account on creation” configurations with account verification via email enabled.