What’s Vulnerable › Vulnerabilities
CVE-2025-0672: Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
- Severity: low (CVSS 3.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-23 · updated 2026-10-18
- Weakness: CWE-287
Description
An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device. This flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.
Affected products
- WSO2 Identity Server: 5.10.0, 5.11.0
- WSO2 Identity Server As Key Manager: 5.10.0
- WSO2 Open Banking Iam: 2.0.0
References
Get alerted when CVE-2025-0672 or the next vulnerability affects your stack