CVE-2025-0672

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device. This flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.

CVSS 3.1

3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-287

Published

2025-09-23

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• wso2:identity_server
• wso2:identity_server_as_key_manager
• wso2:open_banking_iam

References

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3134/

Check your stackJSON