{"id":"GHSA-w82p-r9vw-4rg5","summary":"WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled","details":"A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct \"User does not exist\" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses.\n\nExploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.\n\nThere is a fix available in version 7.8.491, however it has not been published to the Maven registry.","aliases":["CVE-2025-1396"],"modified":"2026-09-10T03:50:28.992834043Z","published":"2025-09-26T09:31:11Z","database_specific":{"cwe_ids":["CWE-203"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-10-08T19:18:42Z","nvd_published_at":"2025-09-26T08:15:38Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1396"},{"type":"WEB","url":"https://github.com/wso2/carbon-identity-framework/commit/5d5d592882a0377c12e19967c6272ccce0fb18ab"},{"type":"PACKAGE","url":"https://github.com/wso2/carbon-identity-framework"},{"type":"WEB","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3983"}],"affected":[{"package":{"name":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt","ecosystem":"Maven","purl":"pkg:maven/org.wso2.carbon.identity.framework/org.wso2.carbon.identity.input.validation.mgt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.8.103"}]}],"versions":["5.25.100","5.25.101","5.25.102","5.25.103","5.25.104","5.25.105","5.25.106","5.25.107","5.25.108","5.25.109","5.25.110","5.25.111","5.25.112","5.25.113","5.25.114","5.25.115","5.25.120","5.25.121","5.25.122","5.25.123","5.25.124","5.25.125","5.25.126","5.25.127","5.25.128","5.25.129","5.25.130","5.25.131","5.25.132","5.25.133","5.25.134","5.25.135","5.25.136","5.25.137","5.25.138","5.25.139","5.25.140","5.25.141","5.25.142","5.25.143","5.25.144","5.25.145","5.25.146","5.25.147","5.25.148","5.25.149","5.25.150","5.25.151","5.25.152","5.25.153","5.25.154","5.25.155","5.25.156","5.25.157","5.25.158","5.25.159","5.25.160","5.25.161","5.25.162","5.25.163","5.25.164","5.25.165","5.25.166","5.25.337","5.25.338","5.25.339","5.25.34","5.25.340","5.25.341","5.25.342","5.25.343","5.25.344","5.25.345","5.25.35","5.25.36","5.25.37","5.25.38","5.25.39","5.25.40","5.25.41","5.25.42","5.25.43","5.25.44","5.25.45","5.25.46","5.25.47","5.25.48","5.25.49","5.25.50","5.25.51","5.25.52","5.25.650","5.25.651","5.25.652","5.25.653","5.25.655","5.25.656","5.25.657","5.25.658","5.25.659","5.25.660","5.25.661","5.25.662","5.25.663","5.25.664","5.25.665","5.25.666","5.25.667","5.25.668","5.25.669","5.25.670","5.25.671","5.25.672","5.25.673","5.25.674","5.25.675","5.25.676","5.25.677","5.25.678","5.25.679","5.25.685","5.25.686","5.25.687","5.25.694","5.25.697","5.25.698","5.25.706","5.25.712","5.25.713","5.25.714","5.25.737","5.25.738","5.25.739","5.25.740","5.25.77","5.25.78","5.25.79","5.25.80","5.25.81","5.25.82","5.25.83","5.25.84","5.25.85","5.25.86","5.25.87","5.25.88","5.25.89","5.25.90","5.25.91","5.25.92","5.25.93","5.25.94","5.25.95","5.25.96","5.25.97","5.25.98","5.25.99","5.27.0","5.27.1","5.27.10","5.27.11","5.27.12","5.27.13","5.27.14","5.27.15","5.27.16","5.27.17","5.27.18","5.27.19","5.27.2","5.27.20","5.27.21","5.27.22","5.27.23","5.27.3","5.27.4","5.27.5","5.27.6","5.27.7","5.27.8","5.27.9","6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.15","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","7.0.105","7.0.106","7.0.107","7.0.109","7.0.110","7.0.28","7.0.29","7.0.30","7.0.31","7.0.32","7.0.33","7.0.34","7.0.35","7.0.36","7.0.37","7.0.38","7.0.39","7.0.40","7.0.41","7.0.42","7.0.43","7.0.44","7.0.45","7.0.46","7.0.80","7.0.81","7.0.82","7.0.83","7.1.10","7.1.11","7.1.12","7.1.13","7.1.14","7.1.15","7.1.16","7.1.17","7.1.18","7.1.19","7.1.20","7.1.21","7.1.22","7.1.23","7.1.24","7.1.25","7.1.26","7.1.27","7.1.28","7.1.29","7.1.30","7.1.31","7.1.32","7.1.33","7.1.34","7.1.35","7.1.36","7.1.37","7.1.38","7.1.39","7.1.40","7.1.41","7.1.42","7.1.43","7.1.44","7.1.45","7.1.46","7.1.47","7.1.48","7.1.49","7.1.50","7.1.51","7.1.54","7.1.55","7.1.56","7.1.57","7.1.7","7.1.8","7.1.9","7.2.0","7.2.1","7.2.10","7.2.11","7.2.12","7.2.13","7.2.14","7.2.15","7.2.16","7.2.17","7.2.18","7.2.19","7.2.2","7.2.20","7.2.21","7.2.22","7.2.23","7.2.24","7.2.3","7.2.4","7.2.42","7.2.43","7.2.44","7.2.45","7.2.5","7.2.6","7.2.7","7.2.8","7.2.9","7.3.1","7.3.2","7.3.3","7.3.34","7.3.35","7.3.4","7.3.5","7.3.6","7.4.13","7.4.14","7.4.15","7.4.16","7.5.0","7.5.1","7.5.10","7.5.11","7.5.12","7.5.13","7.5.14","7.5.15","7.5.16","7.5.17","7.5.18","7.5.19","7.5.2","7.5.20","7.5.21","7.5.22","7.5.23","7.5.24","7.5.25","7.5.26","7.5.27","7.5.28","7.5.29","7.5.3","7.5.30","7.5.31","7.5.32","7.5.33","7.5.34","7.5.35","7.5.36","7.5.37","7.5.38","7.5.4","7.5.5","7.5.6","7.5.7","7.5.8","7.5.9","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.7.100","7.7.101","7.7.102","7.7.103","7.7.104","7.7.105","7.7.106","7.7.257","7.7.258","7.7.259","7.7.260","7.7.261","7.7.262","7.7.263","7.7.264","7.7.265","7.7.266","7.7.267","7.7.268","7.7.269","7.7.74","7.7.75","7.7.76","7.7.77","7.7.78","7.7.79","7.7.80","7.7.81","7.7.82","7.7.83","7.7.84","7.7.85","7.7.86","7.7.87","7.7.88","7.7.89","7.7.90","7.7.91","7.7.92","7.7.93","7.7.94","7.7.95","7.7.96","7.7.97","7.7.98","7.7.99","7.8.0","7.8.1","7.8.100","7.8.101","7.8.102","7.8.103","7.8.2","7.8.3","7.8.92","7.8.93","7.8.94","7.8.95","7.8.96","7.8.97","7.8.98","7.8.99"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-w82p-r9vw-4rg5/GHSA-w82p-r9vw-4rg5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}