Wso2 Email Otp Authenticator
3 CVEs affecting Wso2 Email Otp Authenticator. Latest disclosed: 2026-10-19. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13591 | Medium | 5.3 | 2026-10-19 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attack… |
CVE-2024-0391 | Medium | 5.3 | 2026-05-11 | The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered us… |
CVE-2025-13909 | Medium | 4.3 | 2026-08-06 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-fact… |