Security Advisory WSO2-2025-4731/CVE-2025-13909¶
Published: 2026-05-03
Version: 1.0.0
Severity: Medium
CVSS Score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVE IDs: CVE-2025-13909
AFFECTED PRODUCTS¶
- WSO2 Identity Server: 7.1.0, 7.0.0
OVERVIEW¶
Potential information disclosure risk in multi-tenant deployment.
DESCRIPTION¶
Due to improper validation, personally identifiable user information may be exposed when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators in multi-tenant deployments. This leads to cross-tenant information disclosure and potential privacy violations.
IMPACT¶
Successful exploitation could allow cross-tenant disclosure of personally identifiable information, leading to privacy violations, unauthorized access to user details like mobile number, and potential regulatory non-compliance.
SOLUTION¶
Community Users (Open Source)¶
Apply the relevant fixes to your product using the public fix(es) provided below.
- https://github.com/wso2-extensions/identity-auth-otp-commons/pull/30
- https://github.com/wso2-extensions/identity-local-auth-emailotp/pull/65
- https://github.com/wso2-extensions/identity-local-auth-magiclink/pull/76
- https://github.com/wso2/carbon-identity-framework/pull/7496
If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).
Support Subscription Holders¶
Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.
Info
WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.
| Product Name | Product Version | Update Level |
|---|---|---|
| WSO2 Identity Server | 7.1.0 | 42 |
| WSO2 Identity Server | 7.0.0 | 134 |