CVE-2025-13736

🗓️ 06 Aug 2026 08:16:28Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 9 Views

CVE-2025-13736: Multi-Attribute Login leaks valid usernames and echoes input for non-existent users.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2025-13736	6 Aug 202607:33	–	attackerkb
CVE	CVE-2025-13736	6 Aug 202607:33	–	cve
Cvelist	CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery	6 Aug 202607:33	–	cvelist
EUVD	EUVD-2025-210626	6 Aug 202607:33	–	euvd
Vulnrichment	CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery	6 Aug 202607:33	–	vulnrichment

NVD

Node

OR

wso2 api_managerRange3.1.0–3.1.0.351

wso2 api_managerRange3.2.0–3.2.0.455

wso2 api_managerRange4.0.0–4.0.0.375

wso2 identity_serverRange5.10.0–5.10.0.380

wso2 identity_serverRange5.11.0–5.11.0.427

wso2 identity_serverRange6.0.0–6.0.0.254

wso2 identity_serverRange6.1.0–6.1.0.255

wso2 identity_serverRange7.0.0–7.0.0.132

wso2 identity_serverRange7.1.0–7.1.0.40

wso2 identity_serverRange7.2.0–7.2.0.2

wso2 identity_server_as_key_managerRange5.10.0–5.10.0.371

wso2 open_banking_amRange2.0.0–2.0.0.400

wso2 open_banking_iamRange2.0.0–2.0.0.420

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4013/

12 Aug 2026 19:36Current

CVSS 3.13.7

EPSS0.00171

multi attribute login username leakage non existent users attack risk