CVEvulnerability

CVE-2025-0672

3.8 LOW Published 2025-09-23 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-09-23
Last modified
2026-10-18
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
3.3 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
3.8 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287

Description

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device. This flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.

Affected configurations

• wso2 identity server 5.10.0 • wso2 identity server 5.11.0 • wso2 identity server as key manager 5.10.0 • wso2 open banking iam 2.0.0

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References