---
id: CVE-2025-5802
title: >-
  The self-registration flow accepts user-supplied input for usernames without
  adequately preventing the disclosure of username existence
summary: >-
  The self-registration flow accepts user-supplied input for usernames without
  adequately preventing the disclosure of username existence. When a user
  attempts to register with an existing username, the system responds with an
  error messag…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-203
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 3.1.0 < 3.1.0.354
  - api_manager >= 3.2.0 < 3.2.0.458
  - api_manager >= 3.2.0 < 3.2.0.478
  - api_manager >= 3.2.1 < 3.2.1.96
  - api_manager >= 4.0.0 < 4.0.0.379
  - api_manager >= 4.1.0 < 4.1.0.262
  - api_manager >= 4.2.0 < 4.2.0.200
  - api_manager >= 4.3.0 < 4.3.0.112
  - api_manager >= 4.4.0 < 4.4.0.72
  - api_manager >= 4.5.0 < 4.5.0.55
  - api_manager >= 4.6.0 < 4.6.0.17
  - api_control_plane >= 4.5.0 < 4.5.0.56
  - api_control_plane >= 4.6.0 < 4.6.0.18
  - universal_gateway >= 4.5.0 < 4.5.0.55
  - universal_gateway >= 4.6.0 < 4.6.0.17
  - traffic_manager >= 4.5.0 < 4.5.0.54
  - traffic_manager >= 4.6.0 < 4.6.0.17
  - identity_server >= 5.10.0 < 5.10.0.383
  - identity_server >= 5.11.0 < 5.11.0.430
  - identity_server >= 6.0.0 < 6.0.0.257
  - identity_server >= 6.1.0 < 6.1.0.234
  - identity_server >= 6.1.0 < 6.1.0.257
  - identity_server >= 7.0.0 < 7.0.0.133
  - identity_server >= 7.1.0 < 7.1.0.41
  - identity_server >= 7.2.0 < 7.2.0.3
  - identity_server_as_key_manager >= 5.10.0 < 5.10.0.374
  - open_banking_am >= 2.0.0 < 2.0.0.403
  - open_banking_iam >= 2.0.0 < 2.0.0.423
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util
    >= 5.17.5 < 5.17.5.332
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util
    >= 5.18.187 < 5.18.187.330
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util
    >= 5.23.8 < 5.23.8.213
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util
    >= 5.25.92 < 5.25.92.167
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.endpoint.util
    >= 7.0.78 < 7.0.78.162
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework
    >= 5.17.5 < 5.17.5.332
  - >-
    org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework
    >= 5.18.187 < 5.18.187.330
published: '2026-09-15'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:13:15.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5802'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
tags:
  - nvd
  - cve.org
epss: 0.00251
epssPercentile: 0.16814
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T12:48:59.851340Z'
ingestedAt: '2026-09-15T10:35:28.511Z'
---

## Overview

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use.

This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.