CVE-2025-11850 WSO2 CVE debrief

Who should care

Organizations using the affected product from Unknown Vendor with secondary user stores configured and external Identity Providers (IDPs) may be impacted. Specifically, those with duplicate claim values (e.g., usernames or email addresses) across primary and secondary user stores should assess and mitigate this vulnerability to prevent potential identity confusion and access issues.

Technical summary

The implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks when secondary user stores are configured. This allows a subject to be associated with an unintended local account if the same lookup claim exists in both the primary and a secondary store, potentially leading to identity confusion and access restriction with external IDPs.

Defensive priority

Medium-priority vulnerability with potential for identity confusion and access restriction; verify and mitigate if secondary user stores are configured.

Recommended defensive actions

• Verify if secondary user stores are configured and assess potential impact
• Review and update identity association settings for external IDPs
• Monitor for and address duplicate claim values across user stores
• Consider disabling implicit association if not required
• Implement compensating controls for access restriction if necessary

Evidence notes

Evidence from official CVE and NVD sources indicates a medium-severity vulnerability in an unspecified product from Unknown Vendor, potentially affecting identity association with external IDPs; primary source is NVD with a reference to WSO2 documentation.

Official resources