Cross-tenant PII disclosure caused by tenant-isolation failure in WSO2 Identity Server

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.

• WSO2 Identity Server has default_status: unaffected; affected branches are 7.0.0 with lessThan: 7.0.0.134 and 7.1.0 with lessThan: 7.1.0.42.
• WSO2 Carbon Identity Application Authentication Framework has default_status: unknown; affected branches are 7.0.78 with lessThan: 7.0.78.162 and 7.8.23 with lessThan: 7.8.23.66.
• WSO2 Carbon MagicLink Authenticator Module has default_status: unknown; affected branches are 1.1.22 with lessThan: 1.1.22.6 and 1.1.31 with lessThan: 1.1.31.3.
• WSO2 Carbon Abstract OTP Authenticator has default_status: unknown; affected branches are 1.0.5 with lessThan: 1.0.5.4 and 1.0.10 with lessThan: 1.0.10.1.
• Email OTP Authenticator has default_status: unknown; the affected branch is 1.0.30 with lessThan: 1.0.30.4.
• The record does not establish safe status for every parallel branch or unlisted release, especially for components with default_status: unknown.

WSO2 Identity Server and related authentication components do not sufficiently validate authentication requests to bind them to the correct tenant when Email OTP, SMS OTP, or Magic Link is used as the first-factor authenticator. In a multi-tenant deployment, this failure breaks tenant isolation and can expose personally identifiable information belonging to users in another tenant. The recorded preconditions are a network-reachable authentication service, a low-privileged attacker, no user interaction, and low attack complexity. The record identifies WSO2 Carbon Identity Application Authentication Framework, WSO2 Carbon MagicLink Authenticator Module, WSO2 Carbon Abstract OTP Authenticator, and Email OTP Authenticator, but does not identify the specific endpoint, request field, token, or tenant-validation branch involved. The weakness is classified as CWE-20 and CWE-200.

• Reachability: Exploitation can occur over the network against an affected authentication service.
• Privileges: The record requires low privileges but does not specify the exact account type or minimum permission needed.
• Interaction and complexity: No user interaction is required, and attack complexity is low.
• Status: The record marks public_exploit as false, but known_exploited is unspecified. No named campaign, victim, exploit, or IOC is provided.

The confirmed technical outcome is cross-tenant disclosure of personally identifiable information through multi-tenant authentication flows. The attacker requires low privileges but does not need user interaction, so a compromised or otherwise limited account could potentially be used to probe the affected service. Exposed data may include user details such as mobile numbers, creating privacy risk and potentially requiring investigation across multiple tenants. The record does not show data modification, administrative takeover, credential theft, or service disruption; those outcomes should not be inferred.

• Data confidentiality: PII may cross tenant boundaries, weakening the separation promised between customers or organizational units sharing the deployment.
• Exposed data: User details may be disclosed, including mobile numbers.
• Compliance: The exposure can result in privacy violations and potential regulatory non-compliance.
• Impact limits: The record identifies a confidentiality impact only; it does not identify data modification or service disruption.

1. Update WSO2 Identity Server: For the 7.1.0 branch, apply update level 42, corresponding to the 7.1.0.42 boundary. For the 7.0.0 branch, apply update level 134, corresponding to the 7.0.0.134 boundary.
2. Update the authentication components: Apply the relevant WSO2 fixes for WSO2 Carbon Identity Application Authentication Framework, WSO2 Carbon Abstract OTP Authenticator, Email OTP Authenticator, and WSO2 Carbon MagicLink Authenticator Module.
3. Compare the installed artifact and branch with the boundaries in affected_summary; a fix for one branch does not demonstrate that other branches are safe.
4. If applying the fixes is not feasible, follow the vendor's fallback guidance to migrate to a product release identified as unaffected. The record does not provide one universal fixed release for all parallel component branches.
5. The record and advisory do not specify a temporary mitigation that replaces updating or moving to an unaffected release.

1. Inventory WSO2 Identity Server deployments and the related WSO2 authentication artifacts, then identify systems operating in multi-tenant mode.
2. Record which first-factor authenticators are enabled, especially Email OTP, SMS OTP, and Magic Link.
3. Compare the exact deployed releases of the server, framework, and individual authenticators with the affected branches in affected_summary; checking only the main product version is insufficient.
4. Review authentication audit logs and telemetry for low-privileged sessions or requests that appear to return user data belonging to another tenant, particularly mobile numbers. Treat this as precautionary review, not as a vendor-confirmed indicator.
5. The absence of suspicious log entries does not prove that the system is safe because the record does not define a required log event or specific IOC.