CVE-2025-13909: 
WSO2 Identity Server vulnerability analysis and mitigation

CVE-2025-13909 is an authorization bypass vulnerability in WSO2 Identity Server that fails to enforce tenant isolation when processing authentication requests using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This insufficient validation allows authenticated attackers to access personally identifiable information (PII) belonging to users in other tenants. Affected products include WSO2 Identity Server versions 7.0.0 through 7.0.0.133 and 7.1.0 through 7.1.0.41, along with several underlying component libraries. It was published on August 6, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, WSO2 Advisory).

The root cause is classified under CWE-20 (Improper Input Validation) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The authentication framework fails to adequately validate tenant context during the first-factor authentication step when Email OTP, SMS OTP, or Magic Link authenticators are used, allowing cross-tenant data access. An attacker with low-level authenticated network access can craft authentication requests that bypass tenant boundary checks, causing the system to return PII from a different tenant's user store. Affected components include org.wso2.carbon.identity.application.authentication.framework (versions 7.0.78–7.0.78.161 and 7.8.23–7.8.23.65), the Magic Link authenticator (versions 1.1.22–1.1.22.5 and 1.1.31–1.1.31.2), the OTP core library (versions 1.0.5–1.0.5.3 and 1.0.10–1.0.10.0), and the Email OTP authenticator (versions 1.0.30–1.0.30.3) (GitHub Advisory, WSO2 Advisory).

Successful exploitation enables an authenticated attacker to disclose PII of users in different tenants, including sensitive details such as mobile numbers and other user profile data. This cross-tenant data exposure constitutes a privacy violation and may result in regulatory non-compliance (e.g., GDPR, HIPAA). There is no impact on integrity or availability; the vulnerability is limited to confidentiality of user data across tenant boundaries (GitHub Advisory, WSO2 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low-privilege authenticated access over the network and is not automatable according to NVD SSVC assessment. The EPSS score is approximately 0.20%, placing it in the 11th percentile for exploitation likelihood within 30 days. No threat actor attribution or CISA KEV catalog listing has been identified (GitHub Advisory, WSO2 Advisory).

WSO2 has released patched versions addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• WSO2 Identity Server: 7.0.0.134 or later; 7.1.0.42 or later
• Authentication Framework (org.wso2.carbon.identity.application.authentication.framework): 7.0.78.162 or later; 7.8.23.66 or later
• Magic Link Authenticator: 1.1.22.6 or later; 1.1.31.3 or later
• OTP Core (org.wso2.carbon.identity.auth.otp.core): 1.0.5.4 or later; 1.0.10.1 or later
• Email OTP Authenticator: 1.0.30.4 or later

As a complementary measure, review and strengthen tenant isolation validation logic in the authentication flow for Email OTP, SMS OTP, and Magic Link authenticators, and implement proper tenant context verification at each authentication step (WSO2 Advisory, GitHub Advisory).