Answer in brief
CVE-2025-13166 records a Unknown severity vulnerability in Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery. The current sources do not mark it as known exploited. The current feed maps WSO2/WSO2 Identity Server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WSO2/WSO2 Identity Server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| WSO2/WSO2 Identity Servergeneric | >=7.1.0 <7.1.0.40 || >=7.2.0 <7.2.0.2 | 7.1.0.40, 7.2.0.2 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 15, 2026
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.
Quoted source text, attributed separately from HOL analysis.