Read the docs
TI-2025-00566 Aliases CVE-2025-0672GHSA-gf54-37hh-j4g4

Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association

Priority LOW 17CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device. This flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server as Key Manager (WSO2): 5.10.0.338WSO2 Identity Server (WSO2): 5.10.0.345, 5.11.0.394+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3385.10.0.338Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.345; 5.11.0 to before 5.11.0.3945.10.0.345, 5.11.0.394Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.3892.0.0.389Patch availableCNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.338 Fixed in 5.10.0.338 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.345; 5.11.0 to before 5.11.0.394 Fixed in 5.10.0.345, 5.11.0.394 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.389 Fixed in 2.0.0.389 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
  • cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.338
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.345, 5.11.0.394
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.389

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0672
  2. 2026-10-03 Alias added: GHSA-gf54-37hh-j4g4

References

Advisory 1

  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2018-06290 WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. CVSS 3.0MEDIUM 5.4
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2024-06413 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover CVSS 3.1CRITICAL 9.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences