CVE-2025-13736: Multi-Attribute Login Info Disclosure

CVE-2025-13736 Overview

CVE-2025-13736 is a username enumeration vulnerability affecting WSO2 products when Multi-Attribute Login is enabled. The login interface responds differently for valid and invalid accounts. For valid users, the server resolves and displays the canonical username. For non-existent users, it echoes the original input back to the client. This behavioral difference occurs regardless of the validate_username configuration setting. The flaw is classified under CWE-203: Observable Discrepancy and enables attackers to confirm the existence of valid accounts through crafted login attempts.

Critical Impact
Attackers can enumerate valid usernames without authentication, enabling targeted brute force, credential stuffing, and phishing campaigns against confirmed accounts.

Affected Products

WSO2 products with Multi-Attribute Login enabled (see WSO2 Security Advisory WSO2-2025-4013 for the authoritative product and version list)

Discovery Timeline

2026-08-06 - CVE CVE-2025-13736 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2025-13736

Vulnerability Analysis

The vulnerability stems from inconsistent response handling in the WSO2 login interface. Multi-Attribute Login allows users to authenticate with different identifier types such as username, email, or mobile number. When the feature is enabled, the server resolves the supplied identifier to a canonical username before completing authentication. That resolution step leaks state. When the identifier maps to a real account, the server surfaces the canonical username in its response. When the identifier does not resolve, the server echoes the raw input. An unauthenticated attacker can distinguish valid accounts from invalid ones by comparing responses. The issue persists even when administrators set validate_username to prevent this behavior, making configuration-based mitigation ineffective.

Root Cause

The root cause is an observable discrepancy [CWE-203] in the authentication response path. The code path that handles Multi-Attribute Login resolves identifiers to canonical usernames before uniform response construction. This produces two distinct output patterns for valid versus invalid users. The validate_username configuration flag does not gate the resolution logic, so the discrepancy remains regardless of administrator intent.

Attack Vector

An attacker interacts with the login endpoint over the network without prior authentication or user interaction. The attacker submits candidate identifiers (email addresses, phone numbers, or usernames) sourced from breach corpora or public directories. By comparing response content for each submission, the attacker builds a list of confirmed accounts. This list feeds downstream attacks including password spraying, credential stuffing, and spear-phishing.

No verified public exploit code is available. Refer to the WSO2 Security Advisory WSO2-2025-4013 for vendor technical details.

Detection Methods for CVE-2025-13736

Indicators of Compromise

High volume of failed or unauthenticated login attempts from a single source or distributed sources against WSO2 login endpoints.
Sequential submissions of email addresses or phone numbers rather than username-password pairs.
Login traffic patterns that iterate through dictionaries or user directories without progressing to authenticated sessions.

Detection Strategies

Monitor WSO2 authentication logs for elevated rates of failed identifier lookups against the Multi-Attribute Login endpoint.
Correlate source IPs performing many identifier probes with subsequent password-based login attempts against the same accounts.
Baseline normal login volume per source and alert on statistical outliers targeting the login interface.

Monitoring Recommendations

Enable verbose authentication logging on the identity server and forward logs to a centralized SIEM for analysis.
Track unique identifier submissions per source over rolling time windows to identify enumeration behavior.
Alert on repeated requests to the login endpoint that never proceed to successful authentication.

How to Mitigate CVE-2025-13736

Immediate Actions Required

Apply the WSO2 patches or WUM updates listed in WSO2 Security Advisory WSO2-2025-4013.
Review whether Multi-Attribute Login is required in your deployment and disable it if the feature is not in use.
Enforce rate limiting and account lockout policies at the reverse proxy or web application firewall protecting the login endpoint.
Deploy CAPTCHA challenges on the login interface to raise the cost of automated enumeration.

Patch Information

WSO2 has published fixes and remediation instructions in the WSO2 Security Advisory WSO2-2025-4013. Administrators should consult the advisory for the exact affected versions, patch identifiers, and WUM update instructions applicable to their deployment.

Workarounds

Disable Multi-Attribute Login until the patched version can be deployed.
Place the login endpoint behind a web application firewall configured to detect and throttle enumeration patterns.
Restrict access to the login interface to trusted network ranges where operationally feasible.

bash

# Example: rate-limit login endpoint at an NGINX reverse proxy
limit_req_zone $binary_remote_addr zone=wso2login:10m rate=5r/m;

server {
    location /commonauth {
        limit_req zone=wso2login burst=10 nodelay;
        proxy_pass https://wso2-backend;
    }
}