https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:25:51 +0000 https://vulnerability.circl.lu/vuln/cve-2025-13909 <p><strong>Affected:</strong> WSO2 Identity Server, WSO2 Carbon Identity Application Authentication Framework, WSO2 Carbon MagicLink Authenticator Module, WSO2 Carbon Abstract OTP Authenticator, WSO2 Email OTP Authenticator</p> <p>The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information.</p> <p>Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.</p> <p><strong>Affected:</strong> WSO2 Identity Server, WSO2 Carbon Identity Application Authentication Framework, WSO2 Carbon MagicLink Authenticator Module, WSO2 Carbon Abstract OTP Authenticator, WSO2 Email OTP Authenticator</p> <p>The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information.</p> <p>Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.</p> https://vulnerability.circl.lu/vuln/cve-2025-13909