CVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-18
Weakness: CWE-203

Description

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

Affected products

WSO2 API Manager: from 3.1.0 before 3.1.0.354; from 3.2.0 before 3.2.0.458; from 3.2.0 before 3.2.0.478; from 3.2.1 before 3.2.1.96; from 4.0.0 before 4.0.0.379; from 4.1.0 before 4.1.0.262 — fixed in 3.1.0.354, 3.2.0.458, 3.2.0.478, 3.2.1.96, 4.0.0.379, 4.1.0.262
WSO2 Identity Server: from 5.10.0 before 5.10.0.383; from 5.11.0 before 5.11.0.430; from 6.0.0 before 6.0.0.257; from 6.1.0 before 6.1.0.234; from 6.1.0 before 6.1.0.257; from 7.0.0 before 7.0.0.133 — fixed in 5.10.0.383, 5.11.0.430, 6.0.0.257, 6.1.0.234, 6.1.0.257, 7.0.0.133
WSO2 API Control Plane: from 4.5.0 before 4.5.0.56; from 4.6.0 before 4.6.0.18 — fixed in 4.5.0.56, 4.6.0.18
WSO2 Carbon Identity Application Authentication Framework: from 5.17.5 before 5.17.5.332; from 5.18.187 before 5.18.187.330 — fixed in 5.17.5.332, 5.18.187.330, x
WSO2 Carbon Identity Management Endpoint Util: from 5.17.5 before 5.17.5.332; from 5.18.187 before 5.18.187.330; from 5.23.8 before 5.23.8.213; from 5.25.92 before 5.25.92.167; from 7.0.78 before 7.0.78.162 — fixed in 5.17.5.332, 5.18.187.330, 5.23.8.213, 5.25.92.167, 7.0.78.162, x
WSO2 Identity Server as Key Manager: from 5.10.0 before 5.10.0.374 — fixed in 5.10.0.374
WSO2 Open Banking AM: from 2.0.0 before 2.0.0.403 — fixed in 2.0.0.403
WSO2 Open Banking IAM: from 2.0.0 before 2.0.0.423 — fixed in 2.0.0.423
WSO2 Traffic Manager: from 4.5.0 before 4.5.0.54; from 4.6.0 before 4.6.0.17 — fixed in 4.5.0.54, 4.6.0.17
WSO2 Universal Gateway: from 4.5.0 before 4.5.0.55; from 4.6.0 before 4.6.0.17 — fixed in 4.5.0.55, 4.6.0.17

How to fix

Upgrade to a fixed version: WSO2 API Manager 3.1.0.354, 3.2.0.458, 3.2.0.478, 3.2.1.96; WSO2 Identity Server 5.10.0.383, 5.11.0.430, 6.0.0.257, 6.1.0.234; WSO2 API Control Plane 4.5.0.56, 4.6.0.18; WSO2 Carbon Identity Application Authentication Framework 5.17.5.332, 5.18.187.330, x; WSO2 Carbon Identity Management Endpoint Util 5.17.5.332, 5.18.187.330, 5.23.8.213, 5.25.92.167; WSO2 Identity Server as Key Manager 5.10.0.374; WSO2 Open Banking AM 2.0.0.403; WSO2 Open Banking IAM 2.0.0.423; WSO2 Traffic Manager 4.5.0.54, 4.6.0.17; WSO2 Universal Gateway 4.5.0.55, 4.6.0.17. Check the vendor advisory for mitigations.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/

Get alerted when CVE-2025-5802 or the next vulnerability affects your stack