« Volver al listado

CVE-2025-11850

Estado: AnalizadaMedia (4.3)—

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store.

If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP).

Leer descripción completaMostrar menos

Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wso2 — Identity Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11850",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11850",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-06T12:36:05.941078Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.0.0.132",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.1.0",
              "lessThan": "7.1.0.40",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WSO2",
          "product": "Token Exchange Grant Type For OAuth",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.1.19",
              "versionType": "custom",
              "lessThanOrEqual": "*"
            }
          ],
          "packageName": "org.wso2.carbon.extension.identity.oauth2.grantType.token.exchange:org.wso2.carbon.identity.oauth2.grant.token.exchange",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-08-06T08:16:27.923",
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4493/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store.\n\nIf duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique."
    },
    {
      "lang": "es",
      "value": "Cuando se configuran almacenes de usuarios secundarios, el resolutor de asociación implícita se inicializa incorrectamente desde un almacén de usuarios secundario y omite el almacén de usuarios principal durante las comprobaciones de búsqueda y unicidad. Esto permite que un sujeto se asocie con una cuenta local no deseada si la misma aserción de búsqueda (p. ej., nombre de usuario o correo electrónico) existe tanto en el almacén principal como en uno secundario.\n\nSi existen valores de aserción duplicados entre almacenes de usuarios, este problema puede provocar confusión de identidad debido a asociaciones implícitas incorrectas al usar un Proveedor de Identidad (IDP) externo. Las cuentas de usuario legítimas en el almacén de usuarios principal pueden no asociarse correctamente con sus cuentas IDP externas correspondientes, restringiendo potencialmente el acceso si la cuenta secundaria tiene menos privilegios. Las implementaciones no se ven afectadas si no se configuran almacenes de usuarios secundarios, la asociación implícita está deshabilitada o los valores de aserción son globalmente únicos."
    }
  ],
  "lastModified": "2026-09-29T14:10:00.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D679454-2397-4FBE-A622-32471D759A3D",
              "versionEndExcluding": "7.0.0.132",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8214082-4640-45B5-A8B7-8D032EB773A6",
              "versionEndExcluding": "7.1.0.40",
              "versionStartIncluding": "7.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}