FKIE_CVE-2025-11850

Vulnerability from fkie_nvd - Published: 2026-08-06 08:16 - Updated: 2026-09-29 14:10
Severity
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Summary
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.
References
ed10eef1-636d-4fbe-9993-6890dfa878f8https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4493/Vendor Advisory
Impacted products
Vendor Product Version
wso2 identity_server *
wso2 identity_server *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "7.0.0.132",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.40",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.extension.identity.oauth2.grantType.token.exchange:org.wso2.carbon.identity.oauth2.grant.token.exchange",
          "product": "Token Exchange Grant Type For OAuth",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "1.1.19",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D679454-2397-4FBE-A622-32471D759A3D",
              "versionEndExcluding": "7.0.0.132",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8214082-4640-45B5-A8B7-8D032EB773A6",
              "versionEndExcluding": "7.1.0.40",
              "versionStartIncluding": "7.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store.\n\nIf duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique."
    },
    {
      "lang": "es",
      "value": "Cuando se configuran almacenes de usuarios secundarios, el resolutor de asociaci\u00f3n impl\u00edcita se inicializa incorrectamente desde un almac\u00e9n de usuarios secundario y omite el almac\u00e9n de usuarios principal durante las comprobaciones de b\u00fasqueda y unicidad. Esto permite que un sujeto se asocie con una cuenta local no deseada si la misma aserci\u00f3n de b\u00fasqueda (p. ej., nombre de usuario o correo electr\u00f3nico) existe tanto en el almac\u00e9n principal como en uno secundario.\n\nSi existen valores de aserci\u00f3n duplicados entre almacenes de usuarios, este problema puede provocar confusi\u00f3n de identidad debido a asociaciones impl\u00edcitas incorrectas al usar un Proveedor de Identidad (IDP) externo. Las cuentas de usuario leg\u00edtimas en el almac\u00e9n de usuarios principal pueden no asociarse correctamente con sus cuentas IDP externas correspondientes, restringiendo potencialmente el acceso si la cuenta secundaria tiene menos privilegios. Las implementaciones no se ven afectadas si no se configuran almacenes de usuarios secundarios, la asociaci\u00f3n impl\u00edcita est\u00e1 deshabilitada o los valores de aserci\u00f3n son globalmente \u00fanicos."
    }
  ],
  "id": "CVE-2025-11850",
  "lastModified": "2026-09-29T14:10:00.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11850",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-06T12:36:05.941078Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T08:16:27.923",
  "references": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4493/"
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.