CVE-2025-13736: When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and…

PriorityP416low3.7CVSS 3.1

AVNACHPRNUINSUCLINAN

EPSS

0.27%

17.8th percentile

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration. The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information to craft more effective phishing campaigns or social engineering tactics to compromise user accounts or extract sensitive data.

Affected

26 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_manager	>= 3.1.0 < 3.1.0.351	3.1.0.351
wso2	api_manager	>= 3.2.0 < 3.2.0.455	3.2.0.455
wso2	api_manager	>= 4.0.0 < 4.0.0.375	4.0.0.375
wso2	identity_server	>= 5.10.0 < 5.10.0.380	5.10.0.380
wso2	identity_server	>= 5.11.0 < 5.11.0.427	5.11.0.427
wso2	identity_server	>= 6.0.0 < 6.0.0.254	6.0.0.254
wso2	identity_server	>= 6.1.0 < 6.1.0.255	6.1.0.255
wso2	identity_server	>= 7.0.0 < 7.0.0.132	7.0.0.132
wso2	identity_server	>= 7.1.0 < 7.1.0.40	7.1.0.40
wso2	identity_server	>= 7.2.0 < 7.2.0.2	7.2.0.2
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.371	5.10.0.371
wso2	open_banking_am	>= 2.0.0 < 2.0.0.400	2.0.0.400
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.420	2.0.0.420
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.351	3.1.0.351
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.455	3.2.0.455
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.375	4.0.0.375
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.380	5.10.0.380
wso2	wso2_identity_server	>= 5.11.0 < 5.11.0.427	5.11.0.427
wso2	wso2_identity_server	>= 6.0.0 < 6.0.0.254	6.0.0.254
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.255	6.1.0.255
wso2	wso2_identity_server	>= 7.0.0 < 7.0.0.132	7.0.0.132
wso2	wso2_identity_server	>= 7.1.0 < 7.1.0.40	7.1.0.40
wso2	wso2_identity_server	>= 7.2.0 < 7.2.0.2	7.2.0.2
wso2	wso2_identity_server_as_key_manager	>= 5.10.0 < 5.10.0.371	5.10.0.371
wso2	wso2_open_banking_am	>= 2.0.0 < 2.0.0.400	2.0.0.400

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.