{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"7.8.103"}],"component":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt","cve_ids":["CVE-2025-1396"],"ecosystem":"Maven","epss":0.00251,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w82p-r9vw-4rg5","id":"tcs_01M5N9FX9R67NJ0QZHJSXZFFB4","modified_at":"2026-09-10T03:50:28.992834043Z","published_at":"2025-09-26T09:31:11Z","references":["https://osv.dev/vulnerability/GHSA-w82p-r9vw-4rg5","https://nvd.nist.gov/vuln/detail/CVE-2025-1396","https://github.com/wso2/carbon-identity-framework/commit/5d5d592882a0377c12e19967c6272ccce0fb18ab","https://github.com/wso2/carbon-identity-framework","https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3983"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-w82p-r9vw-4rg5","url":"https://osv.dev/vulnerability/GHSA-w82p-r9vw-4rg5"}],"summary":"WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled"}