CVE-2025-13166: SMS OTP User Enumeration Vulnerability

CVE-2025-13166 Overview

CVE-2025-13166 is a username enumeration vulnerability affecting the Short Message Service One-Time Password (SMS OTP) flow in WSO2 products. The flaw allows unauthenticated remote attackers to distinguish between registered and non-registered user accounts by observing differences in server responses during OTP initiation. The condition is amplified for accounts that lack a configured mobile number, which produces a distinguishable response pattern. Enumerated usernames can support downstream brute force attempts, credential stuffing, and targeted social engineering. The issue is classified under CWE-203: Observable Discrepancy.

Critical Impact
Unauthenticated attackers can enumerate valid usernames through observable differences in SMS OTP responses, enabling reconnaissance for follow-on account takeover attacks.

Affected Products

WSO2 products implementing the SMS OTP authenticator (see WSO2-2025-4353 advisory for the full product and version matrix)
Deployments where users have accounts without an associated mobile number
Identity Server deployments exposing the SMS OTP initiation endpoint to untrusted networks

Discovery Timeline

2026-09-15 - CVE-2025-13166 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2025-13166

Vulnerability Analysis

The vulnerability resides in the SMS OTP authentication flow, which returns non-uniform error messages or response behavior when an OTP is requested for a given username. When the requested account exists but has no mobile number configured, the server response differs from the response returned for a fully provisioned account or a non-existent account. An attacker scripting requests against the OTP initiation endpoint can iterate through candidate usernames and classify each based on the response.

The weakness is a classic observable discrepancy issue. It does not grant direct access to data or accounts, but it removes the anonymity of the username space. Attackers commonly chain enumeration flaws with password spraying, credential stuffing using breached datasets, and phishing campaigns tailored to confirmed account holders.

The EPSS score for this issue is 0.217%, reflecting low expected near-term exploitation likelihood, though enumeration flaws are frequently automated once disclosed.

Root Cause

The root cause is inconsistent error handling in the SMS OTP initiation path. The application returns distinguishable responses for three distinct states: valid user with mobile number, valid user without mobile number, and non-existent user. Secure design requires uniform responses and uniform timing across these states so that no signal is available to unauthenticated callers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits OTP initiation requests to the vulnerable endpoint using a wordlist of candidate usernames. The attacker parses response bodies, status codes, or timing differences to determine which usernames map to registered accounts, prioritizing those without a configured mobile number.

The vulnerability is described in prose only because no verified proof-of-concept code has been published. Refer to the WSO2 Security Advisory WSO2-2025-4353 for vendor-specific technical detail.

Detection Methods for CVE-2025-13166

Indicators of Compromise

High-volume sequential or dictionary-style requests to the SMS OTP initiation endpoint from a single source or small set of source addresses
Requests containing incrementing or wordlist-derived username parameters with no legitimate session context
Elevated rates of OTP initiation attempts that do not progress to OTP verification
Unusual geographic or ASN distribution of clients calling the OTP endpoint

Detection Strategies

Instrument the SMS OTP endpoint with per-username and per-source-IP rate metrics and alert on statistical anomalies
Correlate OTP initiation requests against downstream OTP verification and login attempts to identify probing without follow-through
Deploy web application firewall rules that flag enumeration patterns such as high username cardinality from a single source
Ingest WSO2 authentication logs into a centralized data lake and build behavioral baselines for the SMS OTP flow

Monitoring Recommendations

Monitor authentication logs for spikes in failed or aborted OTP initiations and export them to SIEM tooling
Track unique username counts observed per source IP per hour and alert when thresholds are exceeded
Alert on repeated requests targeting accounts without a configured mobile number, which is the specific enumeration signal
Review CDN and load balancer logs for scripted user-agent strings targeting the OTP endpoint

How to Mitigate CVE-2025-13166

Immediate Actions Required

Review the WSO2 Security Advisory WSO2-2025-4353 and identify affected product versions in your environment
Apply the vendor-supplied patch or configuration update as soon as it is available for your deployment
Restrict network exposure of the SMS OTP initiation endpoint to trusted networks or client applications where feasible
Enable rate limiting and CAPTCHA challenges on OTP initiation to slow automated enumeration

Patch Information

WSO2 has published remediation guidance in advisory WSO2-2025-4353. Consult the advisory for the authoritative list of affected products, fixed versions, and upgrade or WUM (WSO2 Update Manager) instructions. Apply the update in a staged manner, validating that the SMS OTP flow returns uniform responses for all input classes after patching.

Workarounds

Configure the SMS OTP authenticator to return uniform, generic responses regardless of whether the username exists or has a mobile number
Implement equalized response timing on the OTP initiation endpoint to remove timing-based enumeration signals
Enforce aggressive rate limits and source-IP throttling on the OTP endpoint
Require an authenticated session or a bot-protection challenge before invoking OTP initiation where the deployment permits

bash

# Example rate-limiting configuration concept for the OTP endpoint
# Consult WSO2 documentation for product-specific throttling syntax
# Limit: 5 OTP initiation requests per source IP per minute
# Action: reject with generic error message and log for SIEM ingestion