CVE-2025-1396: WSO2 Input Validation Management Service Username Enumeration Vulnerability
Summary
CVE-2025-1396: A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. Affects org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt versions < 7.8.103. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WSO2 Input Validation Management Service is a component of the WSO2 Identity Framework that facilitates the management of input validation mechanisms for user authentication. It is designed to enhance security by validating user inputs across various authentication methods. However, a vulnerability exists when Multi-Attribute Login is enabled, which can lead to security risks.
Vulnerability Detail
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct 'User does not exist' error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses. Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the Multi-Attribute Login feature until the patch is applied. This can help mitigate the risk of username enumeration until the vulnerability is fully addressed.
Conclusion
The WSO2 Input Validation Management Service has a significant username enumeration vulnerability that can be exploited by attackers. It is crucial to update to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor and identify vulnerabilities in your software.
See every vulnerability recorded for org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt →
FAQ
The vulnerability allows attackers to enumerate valid usernames based on distinct error messages returned by the system.
Malicious actors can exploit this vulnerability to confirm the existence of usernames, which can lead to brute-force attacks or targeted phishing campaigns.
Yes, a patch is available in version 7.8.491 of the affected package.
As a temporary measure, consider disabling the Multi-Attribute Login feature to reduce the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file. Visit Vulert Scanner to check if your application is affected without requiring any signup.
