CVE-2025-13475 Overview
CVE-2025-13475 is a broken authentication vulnerability [CWE-288] affecting the application consent management mechanism in multi-tenanted deployments. The flaw causes consent scopes to leak between tenants when SaaS applications share the same name across tenants. A user granting consent to a SaaS application in one tenant unintentionally authorizes access for identically named applications in other tenants. This exposes user data across tenant boundaries and allows unauthorized read access without explicit authorization. Deployments not configured for multi-tenancy are unaffected. The vulnerability is documented in WSO2 Security Advisory WSO2-2025-1613.
Critical Impact
Consent granted in one tenant is incorrectly applied to same-named SaaS applications in other tenants, enabling cross-tenant data exposure without user authorization.
Affected Products
- Multi-tenanted WSO2 deployments (see WSO2 Security Advisory WSO2-2025-1613 for specific product versions)
- Deployments using the application consent management mechanism
- Environments where multiple tenants host SaaS applications with identical names
Discovery Timeline
- 2026-07-04 - CVE-2025-13475 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2025-13475
Vulnerability Analysis
The vulnerability resides in the consent management workflow used to authorize SaaS applications against user accounts. When the mechanism records a consent decision, it fails to bind the grant to the tenant context of the requesting application. Instead, the consent is keyed by application name alone. Any SaaS application sharing that name in a different tenant inherits the grant.
This breaks the tenant isolation model that multi-tenant identity platforms rely on. An authenticated user in tenant A who consents to App-Alpha unintentionally grants the same scopes to App-Alpha instances registered in tenant B or tenant C. The impact is limited to confidentiality of user data. Integrity and availability are not directly affected, and the attacker must have low-privileged authenticated access with user interaction required to trigger consent.
Root Cause
The underlying issue is authentication and authorization scoping failure classified as [CWE-288]. The consent lookup does not include the tenant identifier as part of the composite key that maps a user, an application, and granted scopes. Consent records therefore match across tenant boundaries whenever application names collide.
Attack Vector
Exploitation requires an attacker to control or register a SaaS application in a separate tenant using the same name as a legitimate application in the target tenant. When a targeted user completes an OAuth or OpenID Connect authorization flow and consents to the legitimate application, the malicious tenant's identically named application inherits the consent. The attacker's application can then request tokens and access user data or invoke APIs on behalf of the victim without further prompts. Refer to the WSO2 Security Advisory WSO2-2025-1613 for vendor technical details.
Detection Methods for CVE-2025-13475
Indicators of Compromise
- Consent grant records referencing SaaS applications with duplicate names across multiple tenants
- OAuth token issuance events for users who never interacted with the requesting tenant's application
- Audit log entries showing API access to user resources from applications the user did not explicitly authorize in the current tenant
Detection Strategies
- Audit the consent store for application name collisions between tenants and correlate consent decisions with the tenant of the originating authorization request.
- Review OAuth and OIDC token issuance logs for grants where the client_id tenant differs from the tenant of the consenting user.
- Inspect user access history for anomalous cross-tenant API calls that follow a consent event in a different tenant.
Monitoring Recommendations
- Ingest identity provider audit logs into a centralized data lake and alert on consent events that resolve to multiple tenants.
- Track newly registered SaaS applications and flag names that duplicate existing applications in other tenants.
- Baseline expected token issuance volume per application per tenant and alert on deviations that suggest consent inheritance.
How to Mitigate CVE-2025-13475
Immediate Actions Required
- Apply the fixes referenced in WSO2 Security Advisory WSO2-2025-1613 to affected multi-tenanted deployments.
- Enumerate SaaS application registrations across all tenants and identify name collisions that could have been abused.
- Revoke existing consent grants in multi-tenanted environments and require users to re-consent under the patched consent scoping logic.
Patch Information
WSO2 has published remediation guidance in advisory WSO2-2025-1613. Administrators should consult the official WSO2 Security Advisory for supported product versions, patch identifiers, and upgrade paths. Non-multi-tenanted deployments do not require patching for this issue.
Workarounds
- Enforce unique application naming policies across tenants to eliminate the collision condition exploited by this flaw.
- Restrict SaaS application registration to trusted administrators and require review before new applications become discoverable to end users.
- Disable multi-tenancy features in deployments that do not require them until the patch can be applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
