Executive brief
WSO2 Identity Server handles SMS-based one-time password authentication for user account login. The SMS OTP flow fails to properly mask error messages, allowing attackers to determine whether specific usernames exist in the system—particularly for accounts without a registered mobile number. This information can be weaponized for targeted phishing campaigns, brute-force attacks, and social engineering, damaging customer trust and creating regulatory compliance risks.
Technical details
The vulnerability is a user enumeration weakness in the SMS OTP authentication flow caused by improper error message handling. Attackers can send OTP initiation requests and analyze the response messages to infer whether a username is registered, with heightened success against accounts lacking a configured mobile number. The attack vector is network-based and requires no authentication or user interaction. A successful enumeration does not directly compromise user data or system functionality, but generates a list of valid usernames that facilitates follow-on attacks (brute force, social engineering). Fixes are available via GitHub pull request and product updates (Identity Server 7.2.0 update 2, 7.1.0 update 40).
Affected products
- WSO2 Identity Server 7.1.0, 7.2.0
Timeline
- 2026-05-03: disclosed
- 2026-05-03: patched: Fixes available via GitHub PR #9434 and product updates