CVE-2025-13909 Overview
CVE-2025-13909 affects WSO2 identity products that use passwordless authentication as the first factor. The system accepts authentication requests without sufficient validation to enforce tenant isolation when Email OTP, SMS OTP, or Magic Link authenticators are used. An authenticated attacker in one tenant can disclose personally identifiable information belonging to users in different tenants. Exposed data may include mobile numbers and other user details tied to accounts. The flaw stems from improper input validation [CWE-20] within the authentication request handling logic. See the WSO2 Security Advisory WSO2-2025-4731 for the full vendor statement.
Critical Impact
Cross-tenant disclosure of personally identifiable information, including user mobile numbers, leading to privacy violations and regulatory non-compliance exposure.
Affected Products
- WSO2 products using Email OTP as a first-factor authenticator
- WSO2 products using SMS OTP as a first-factor authenticator
- WSO2 products using Magic Link as a first-factor authenticator
Discovery Timeline
- 2026-08-06 - CVE-2025-13909 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2025-13909
Vulnerability Analysis
The vulnerability resides in the first-factor authentication path used by passwordless authenticators. When a client submits an authentication request that references a user identifier, the server does not adequately verify that the identifier belongs to the tenant context of the request. The result is a boundary violation between tenants that share the same identity platform deployment.
Attackers with low-privilege authenticated access to one tenant can craft authentication requests targeting identifiers associated with users in another tenant. The response path leaks user attributes such as mobile numbers. The scope is limited to confidentiality, with no integrity or availability impact reported by the vendor.
Root Cause
The root cause is improper input validation [CWE-20] in the authentication request processor. Tenant scoping is not enforced consistently across the Email OTP, SMS OTP, and Magic Link flows. The authentication logic treats a validated session or request as sufficient authority to resolve user data, without re-checking whether the referenced user belongs to the requesting tenant.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker with a valid account in any tenant on the affected deployment can send crafted authentication requests through the standard OTP or Magic Link endpoints. No user interaction is required. Exploitation targets the authentication API surface directly, and the vulnerability manifests during identifier resolution rather than credential verification. See the WSO2 Security Advisory WSO2-2025-4731 for endpoint-specific details.
Detection Methods for CVE-2025-13909
Indicators of Compromise
- Authentication requests to Email OTP, SMS OTP, or Magic Link endpoints referencing user identifiers that do not exist in the requesting tenant.
- Unusual volume of first-factor authentication attempts from a single authenticated principal across multiple user identifiers.
- Application logs showing successful user attribute resolution for identifiers outside the caller's tenant scope.
Detection Strategies
- Correlate authentication request logs with tenant membership records to identify cross-tenant identifier lookups.
- Baseline normal authenticator usage per tenant and alert on enumeration-style request patterns against OTP and Magic Link endpoints.
- Inspect responses from passwordless authentication endpoints for leaked personally identifiable information fields such as mobile numbers.
Monitoring Recommendations
- Enable verbose audit logging on the WSO2 identity server authentication endpoints and forward logs to a centralized analytics platform.
- Monitor rate and diversity of user identifiers submitted per session, per source IP, and per API client.
- Track error and success ratios on OTP and Magic Link flows to detect probing behavior.
How to Mitigate CVE-2025-13909
Immediate Actions Required
- Apply the fixes documented in the WSO2 Security Advisory WSO2-2025-4731 as soon as they are available for your product version.
- Audit recent authentication logs for cross-tenant identifier lookups against Email OTP, SMS OTP, and Magic Link endpoints.
- Restrict network access to identity server administrative and authentication APIs to trusted networks where feasible.
Patch Information
WSO2 has published security advisory WSO2-2025-4731 covering this issue. Consult the WSO2 Security Advisory WSO2-2025-4731 for the list of affected products, fixed versions, and required update steps.
Workarounds
- Disable Email OTP, SMS OTP, and Magic Link as first-factor authenticators until the vendor patch is applied.
- Require a password-based first factor and use OTP or Magic Link only as a second factor.
- Segment tenants across separate deployments where cross-tenant risk is unacceptable pending remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
