CVE-2025-13591: WSO2 Identity Server username enumeration in authentication endpoint

CVE-2025-13591 · Severity: medium · CVSS 5.3 · Published 2026-10-19

WSO2 Identity Server, an identity and access management platform, reveals whether a username exists in the system through inconsistent authentication responses. An attacker can exploit this to discover valid usernames, which can then be used for brute-force attacks, phishing campaigns, and other targeted social engineering attacks.

Technologies: Wso2 Identity Server. Vendors: Wso2.

Quick answers

Is CVE-2025-13591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13591 being exploited in the wild.
How severe is CVE-2025-13591?
Medium severity, with a CVSS score of 5.3, published 19 October 2026.
Which products and versions are affected?
Wso2 Identity Server 7.0.0, 7.1.0.
Is there a fix for CVE-2025-13591?
Yes: fixed in Identity Server 7.0.0 update 134, 7.1.0 update 42 (with configuration change). Until then: Apply the relevant patch from the GitHub pull requests, then add the configuration hide_user_existence = true to the [authentication.local_authenticators] section in /repository/conf/deployment.toml; the patch alone is insufficient without this configuration change. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13591 attacked?
It is attacked over the network.
Am I affected by CVE-2025-13591?
Check whether you run Wso2 Identity Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Identity Server 7.0.0 update 134, 7.1.0 update 42 (with configuration change)

Apply the relevant patch from the GitHub pull requests, then add the configuration hide_user_existence = true to the [authentication.local_authenticators] section in /repository/conf/deployment.toml; the patch alone is insufficient without this configuration change.

Technical details

The authentication endpoint returns distinct responses based on user existence, enabling username enumeration without authentication. The vulnerability affects versions 7.0.0 and 7.1.0 and is exploitable over the network with no prerequisites. Mitigation requires applying supplied patches plus adding the hide_user_existence configuration to deployment.toml.

Affected products

  • WSO2 Identity Server 7.0.0, 7.1.0

Timeline

  • 2026-05-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.