org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core vulnerabilities

CVEs whose affected-version data names the org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-13591Medium· 5.3

today

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in r…

▾ SunlitWSO2 · WSO2 Identity Servervia CVEORG