Executive brief
WSO2 Identity Server and API Manager are identity and API management platforms used to manage user access and authentication across enterprise systems. A flaw in their self-registration flow reveals whether a username already exists in the system, allowing attackers to discover valid user accounts and use that information to launch targeted phishing, social engineering, or brute-force attacks against known users.
Technical details
The vulnerability is a username enumeration flaw in the self-registration flow. When a user attempts to register with an already-existing username, the system returns an error message explicitly stating the username is in use, allowing attackers to probe for valid usernames. The attack requires network access to the self-registration endpoint and no authentication; an attacker can iterate through potential usernames to enumerate valid accounts. This information can be weaponized for targeted social engineering, phishing, and credential-stuffing attacks. Fixes are available via patches, GitHub PRs (identity-governance#1097, product-apim#14023, carbon-apimgt#13650), and configuration changes to disable the "Display message if username unavailable" option.
Affected products
- WSO2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0, 7.2.0
- WSO2 API Manager 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 Identity Server as Key Manager 5.10.0
- WSO2 Open Banking AM 2.0.0
- WSO2 Open Banking IAM 2.0.0
- WSO2 Traffic Manager 4.5.0, 4.6.0
- WSO2 Universal Gateway 4.5.0, 4.6.0
Timeline
- 2026-07-04: disclosed: Security advisory published by WSO2