{"api_version":"1","generated_at":"2026-11-07T05:57:59+00:00","cve":"CVE-2025-5802","urls":{"html":"https://cve.report/CVE-2025-5802","api":"https://cve.report/api/cve/CVE-2025-5802.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-5802","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-5802"},"summary":{"title":"Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery","description":"The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.\n\nThis behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-09-15 10:17:02","updated_at":"2026-09-18 19:13:15"},"problem_types":["CWE-203","CWE-203 CWE-203: Information Disclosure Through Error Messages"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5802","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5802","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 3.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.1.0 3.1.0.354 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.458 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.478 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.96 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.379 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.262 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.200 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.112 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.4.0 4.4.0.72 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.5.0 4.5.0.55 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.6.0 4.6.0.17 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.5.0 4.5.0.56 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.6.0 4.6.0.18 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"affected 4.5.0 4.5.0.55 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"affected 4.6.0 4.6.0.17 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"unknown 4.5.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"affected 4.5.0 4.5.0.54 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"affected 4.6.0 4.6.0.17 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.10.0 5.10.0.383 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.430 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.257 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.234 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.257 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.133 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.1.0 7.1.0.41 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.2.0 7.2.0.3 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.10.0 5.10.0.374 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 2.0.0 2.0.0.403 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"affected 2.0.0 2.0.0.423 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"affected 5.17.5 5.17.5.332 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"affected 5.18.187 5.18.187.330 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"affected 5.23.8 5.23.8.213 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"affected 5.25.92 5.25.92.167 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"affected 7.0.78 7.0.78.162 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Management Endpoint Util","version":"unaffected x * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"affected 5.17.5 5.17.5.332 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"affected 5.18.187 5.18.187.330 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"unaffected x * custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"5802","cve":"CVE-2025-5802","epss":"0.002510000","percentile":"0.167710000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:18"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-5802","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-15T12:48:59.851340Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-15T12:49:19.401Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.354","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.458","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.0.478","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.96","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.379","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.262","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.200","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.112","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.72","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.55","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.17","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.56","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.18","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.55","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.17","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.54","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.17","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.383","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.430","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.257","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.234","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"6.1.0.257","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.133","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.41","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.0.3","status":"affected","version":"7.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.374","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.403","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.423","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util","product":"WSO2 Carbon Identity Management Endpoint Util","vendor":"WSO2","versions":[{"lessThan":"5.17.5.332","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.18.187.330","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.23.8.213","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.25.92.167","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"7.0.78.162","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"x","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework","product":"WSO2 Carbon Identity Application Authentication Framework","vendor":"WSO2","versions":[{"lessThan":"5.17.5.332","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.18.187.330","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"x","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.\n\nThis behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns."}],"value":"The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.\n\nThis behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns."}],"impacts":[{"capecId":"CAPEC-101","descriptions":[{"lang":"en","value":"CAPEC-101 CAPEC-101: User Enumeration"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-203","description":"CWE-203: Information Disclosure Through Error Messages","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-15T09:53:53.465Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/#solution"}],"source":{"advisory":"WSO2-2025-4227","discovery":"INTERNAL"},"title":"Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2025-5802","datePublished":"2026-09-15T09:53:53.465Z","dateReserved":"2025-06-06T09:33:38.579Z","dateUpdated":"2026-09-15T12:49:19.401Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 10:17:02","lastModifiedDate":"2026-09-18 19:13:15","problem_types":["CWE-203","CWE-203 CWE-203: Information Disclosure Through Error Messages"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T12:48:59.851340Z","id":"CVE-2025-5802","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"5802","Ordinal":"1","Title":"Username Enumeration via Self Registration Flow in Multiple WSO2","CVE":"CVE-2025-5802","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"5802","Ordinal":"1","NoteData":"The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.\n\nThis behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.","Type":"Description","Title":"Username Enumeration via Self Registration Flow in Multiple WSO2"}]}}}