CVE-2025-11850
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This can lead to associating a subject with an unintended local account if the same lookup claim exists in both stores.
Risk Assessment
Identity confusion may occur, potentially restricting access for legitimate users or assigning them incorrect accounts, especially when using an external IDP.
Recommendation
Ensure claim values are globally unique or disable implicit association if not required. Review user store configuration.
Other vulnerabilities in WSO2
See all- CVE-2025-9312Critical
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations.
- CVE-2025-12317Medium
In WSO2 products, when internal roles are removed from a user, the system fails to invalidate previously issued authentication tokens. Users may retain access privileges even after role revocation.
- CVE-2024-6541Medium
The Class Mediator in WSO2 products fails to properly validate or sanitize messageContext properties used for dynamic values. Authenticated users may access or modify data across invocations.
- CVE-2026-0637Medium
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties without sufficient validation or sanitization. An attacker with access to 'wso2carbon' log files could retrieve sensitive information, such as credentials, potentially leading to unauthorized access.
- CVE-2025-13909Medium
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This can lead to exposure of personally identifiable information of users in different tenants.
- CVE-2026-4249High
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.
Original NVD description (English source)
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.