WSO2 Federated Identity Provider Account Provisioning Vulnerability Allowing User Information Replacement

A vulnerability exists in WSO2 when the 'Silent Just-In-Time Provisioning' feature is enabled for a federated identity provider. This vulnerability allows for the risk of overwriting local user store information during the account provisioning process, particularly when federated users have the same username as local users. The issue arises only if an identity provider is configured for federated authentication with Silent JIT provisioning enabled, and a malicious actor has a valid user account in the federated identity provider that has not been used previously, along with knowledge of a valid username in the local identity provider.

Impact

Exploitation of this vulnerability could lead to unauthorized replacement of local user information with that of a federated identity provider user, potentially allowing for misuse of the local account.