The email OTP flow in several WSO2 products validates user input incorrectly, allowing an attacker to determine whether a given email address is registered as a user account. This constitutes an account enumeration vulnerability, enabling an adversary to gather a list of valid usernames that can later be targeted for brute‑force or social‑engineering attacks. The weakness is classified as CWE‑204, a flaw in how input is validated when checking account lock states.

The affected products include WSO2 Email OTP Authenticator, the WSO2 Carbon Authenticator Library for EmailOTP, WSO2 Identity Server, WSO2 Identity Server as Key Manager, and WSO2 Open Banking IAM. No specific version constraints were provided, so all released versions of these components are potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of being exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker could exploit this remotely by sending crafted OTP verification requests to the authentication endpoint, thereby inferring the existence of registered accounts needed to launch further attacks.