{"id":"CVE-2025-0672","aliases":["EUVD-2025-30912","GHSA-gf54-37hh-j4g4"],"status":"published","title":"Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association","description":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.\n\nThis flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00215,"percentile":0.11933,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2025-09-23T17:30:42Z","modified":"2026-10-18T21:10:00Z","products":[{"vendor":"wso2","product":"identity_server"},{"vendor":"wso2","product":"identity_server_as_key_manager"},{"vendor":"wso2","product":"open_banking_iam"},{"vendor":"wso2","product":"wso2 identity server"},{"vendor":"wso2","product":"wso2 identity server as key manager"},{"vendor":"wso2","product":"wso2 open banking iam"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3134/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0672"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3134"},{"url":"https://github.com/advisories/GHSA-gf54-37hh-j4g4"}],"sources":{"cve":[{"id":"CVE-2025-0672","title":"Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association","description":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.\n\nThis flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.","status":"published","published":"2025-09-23T17:30:42.687Z","modified":"2025-09-25T16:01:00.676Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-30912","description":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.\n\nThis flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.","status":"published","published":"2025-09-23T17:30:42Z","modified":"2025-09-25T16:01:00Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:39.520931Z"}],"ghsa":[{"id":"GHSA-gf54-37hh-j4g4","title":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication...","description":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.\n\nThis flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.","status":"published","published":"2025-09-23T18:30:25Z","modified":"2025-09-25T18:30:33Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:03:45.893243Z"}],"nvd":[{"id":"CVE-2025-0672","description":"An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.\n\nThis flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.","status":"published","published":"2025-09-23T18:15:30.863Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:11:32.559087Z"}]}}