# CVE-2025-5802: WSO2 Identity Server username enumeration in self-registration

Source: https://junglewise.ai/threats/cve-2025-5802-wso2-identity-server-username-enumeration-in-self-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-5802 · Severity: medium · CVSS 5.3 · Published 2026-09-15

WSO2 Identity Server and API Manager are identity and API management platforms used to manage user access and authentication across enterprise systems. A flaw in their self-registration flow reveals whether a username already exists in the system, allowing attackers to discover valid user accounts and use that information to launch targeted phishing, social engineering, or brute-force attacks against known users.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Identity Server](https://junglewise.ai/threats/technologies/identity-server), [Wso2 Identity Server as Key Manager](https://junglewise.ai/threats/technologies/identity-server-as-key-manager), [Wso2 Open Banking AM](https://junglewise.ai/threats/technologies/open-banking-am), [Wso2 Open Banking IAM](https://junglewise.ai/threats/technologies/open-banking-iam), [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2025-5802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5802 being exploited in the wild.

**How severe is CVE-2025-5802?** Medium severity, with a CVSS score of 5.3, published 15 September 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0, 7.2.0; Wso2 Identity Server as Key Manager 5.10.0; and 4 more.

**Is there a fix for CVE-2025-5802?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-5802 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-5802?** Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a username enumeration flaw in the self-registration flow. When a user attempts to register with an already-existing username, the system returns an error message explicitly stating the username is in use, allowing attackers to probe for valid usernames. The attack requires network access to the self-registration endpoint and no authentication; an attacker can iterate through potential usernames to enumerate valid accounts. This information can be weaponized for targeted social engineering, phishing, and credential-stuffing attacks. Fixes are available via patches, GitHub PRs (identity-governance#1097, product-apim#14023, carbon-apimgt#13650), and configuration changes to disable the "Display message if username unavailable" option.

## Affected products

- WSO2 Identity Server 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0, 7.2.0
- WSO2 API Manager 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 Identity Server as Key Manager 5.10.0
- WSO2 Open Banking AM 2.0.0
- WSO2 Open Banking IAM 2.0.0
- WSO2 Traffic Manager 4.5.0, 4.6.0
- WSO2 Universal Gateway 4.5.0, 4.6.0

## Timeline

- 2026-07-04: disclosed: Security advisory published by WSO2

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/)

## Related threats

- [WSO2 Identity Server privilege escalation via client credentials grant type](https://junglewise.ai/threats/cve-2025-11229-the-system-fails-to-properly-enforce-scope-authorization-when-the)
- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 Access token issuance without IDP status validation](https://junglewise.ai/threats/cve-2025-1397-when-utilizing-jwt-bearer-or-saml2-bearer-grant-types-the-system)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)