CVE-2025-5802

published 2026-09-15

CVE-2025-5802: The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts…

Priority P4 27 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.

This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

Affected

35 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.56	4.5.0.56
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.18	4.6.0.18
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.354	3.1.0.354
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.458	3.2.0.458
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.478	3.2.0.478
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.96	3.2.1.96
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.379	4.0.0.379
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.262	4.1.0.262
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.200	4.2.0.200
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.112	4.3.0.112
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.72	4.4.0.72
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.17	4.6.0.17
wso2	wso2_carbon_identity_application_authentication_framework	>= 5.17.5 < 5.17.5.332	5.17.5.332
wso2	wso2_carbon_identity_application_authentication_framework	>= 5.18.187 < 5.18.187.330	5.18.187.330
wso2	wso2_carbon_identity_management_endpoint_util	>= 5.17.5 < 5.17.5.332	5.17.5.332
wso2	wso2_carbon_identity_management_endpoint_util	>= 5.18.187 < 5.18.187.330	5.18.187.330
wso2	wso2_carbon_identity_management_endpoint_util	>= 5.23.8 < 5.23.8.213	5.23.8.213
wso2	wso2_carbon_identity_management_endpoint_util	>= 5.25.92 < 5.25.92.167	5.25.92.167
wso2	wso2_carbon_identity_management_endpoint_util	>= 7.0.78 < 7.0.78.162	7.0.78.162
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.383	5.10.0.383
wso2	wso2_identity_server	>= 5.11.0 < 5.11.0.430	5.11.0.430
wso2	wso2_identity_server	>= 6.0.0 < 6.0.0.257	6.0.0.257
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.234	6.1.0.234
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.257	6.1.0.257

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-203