CVE-2025-13166 in Identity Server
Summary
by MITRE • 09/15/2026
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.
This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described constitutes a classic user enumeration flaw within the SMS One-Time Password authentication flow, specifically categorized under CWE-204: Observable Response Discrepancy. This security weakness arises from an application's failure to implement consistent error handling mechanisms when processing OTP initiation requests. Instead of returning uniform responses for both valid and invalid phone numbers or usernames, the system leaks information through subtle differences in response time, HTTP status codes, or message body content. An attacker can exploit this by submitting a series of authentication requests with varying identifiers and analyzing the server's reactions to deduce which accounts are registered within the platform. This behavior violates fundamental principles of secure design that mandate treating all inputs equally regardless of their validity to prevent information leakage.
The operational impact of this vulnerability is significant, as it serves as an initial reconnaissance step for more severe attacks. By successfully enumerating valid user accounts, particularly those linked to mobile numbers but potentially extending to other identifiers depending on the specific implementation logic, attackers can build a targeted list of potential victims. This intelligence drastically reduces the search space for subsequent brute force attacks against passwords or PINs, making such attempts far more efficient and likely to succeed. Furthermore, knowing which users are active allows adversaries to tailor social engineering campaigns with greater precision, increasing the likelihood of phishing success or credential theft through pretexting. The exposure of valid account structures also contributes to broader information leakage, undermining user privacy expectations.
From a regulatory perspective, this vulnerability can lead to non-compliance with data protection standards such as GDPR or CCPA if personal identifiable information is exposed during the enumeration process. Organizations may face reputational damage and loss of customer trust when users realize their existence within the system was easily discoverable by malicious actors. The ATT&CK framework classifies this activity under T1087: Account Discovery, which is a common tactic used in the early stages of an intrusion kill chain to map out target environments before launching direct attacks on specific assets or credentials.
To mitigate this vulnerability, developers must ensure that all responses returned during the OTP initiation process are identical regardless of whether the provided identifier corresponds to a registered user. This includes standardizing HTTP status codes, response times through artificial delays if necessary, and error message text. Implementing rate limiting is also critical to prevent automated enumeration tools from efficiently probing large numbers of accounts in short periods. Additionally, organizations should monitor for unusual patterns of authentication failures or OTP requests associated with single IP addresses or user agents, which may indicate active enumeration attempts. Regular security testing using both static analysis and dynamic penetration testing can help identify these discrepancies before they are exploited in production environments.