CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.134",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.42",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity Application Authentication Framework",
    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.78",
        "lessThan": "7.0.78.162",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.8.23",
        "lessThan": "7.8.23.66",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "7.8.550",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon MagicLink Authenticator Module",
    "packageName": "org.wso2.carbon.identity.local.auth.magiclink:org.wso2.carbon.identity.application.authenticator.magiclink",
    "versions": [
      {
        "status": "affected",
        "version": "1.1.22",
        "lessThan": "1.1.22.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.1.31",
        "lessThan": "1.1.31.3",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.1.45",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Abstract OTP Authenticator",
    "packageName": "org.wso2.carbon.identity.auth.otp.commons:org.wso2.carbon.identity.auth.otp.core",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.5",
        "lessThan": "1.0.5.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.0.10",
        "lessThan": "1.0.10.1",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.0.24",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "Email OTP Authenticator",
    "packageName": "org.wso2.carbon.identity.local.auth.emailotp:org.wso2.carbon.identity.local.auth.emailotp",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.30",
        "lessThan": "1.0.30.4",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.0.51",
        "lessThanOrEqual": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]