Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (WSO2 WSO2 Identity Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.67 % · percentile 52 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Analyzed
Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
Weaknesses (CWE)
- CWE-693 — Protection Mechanism Failure
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | WSO2 |
| CVSS 3.1 | CRITICAL 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
European references
- ENISA EUVD · EUVD-2025-210632
- GCVE · GCVE-0-2025-15039
Affected configurations (NVD CPE)
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.45cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*≥ 4.6.0 < 4.6.0.9cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 2.6.0 < 2.6.0.150cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.0.180cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.0.356cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.0.460cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.1 < 3.2.1.79cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.0.381cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.244cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.0.184cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.0.95cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.0.59cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.44cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.6.0 < 4.6.0.8cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.7.0 < 5.7.0.130cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.8.0 < 5.8.0.133cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.9.0 < 5.9.0.173cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.385cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.11.0 < 5.11.0.432cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.0.259cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.0.260cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.0.138cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.1.0 < 7.1.0.49cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.2.0 < 7.2.0.7cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*≥ 5.7.0 < 5.7.0.129cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*≥ 5.9.0 < 5.9.0.179cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.376cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.0.143cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*≥ 1.5.0 < 1.5.0.144cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.405cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.425cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.0.137cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*≥ 1.5.0 < 1.5.0.127cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.43cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*≥ 4.6.0 < 4.6.0.8cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.44cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*≥ 4.6.0 < 4.6.0.8
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 Identity Server | unknown 0 < 5.7.0 ; affected 5.7.0 < 5.7.0.130 ; affected 5.8.0 < 5.8.0.113 ; affected 5.9.0 < 5.9.0.173 ; affected 5.10.0 < 5.10.0.385 ; affected 5.11.0 < 5.11.0.432 |
| WSO2 · WSO2 API Manager | unknown 0 < 2.6.0 ; affected 2.6.0 < 2.6.0.150 ; affected 3.0.0 < 3.0.0.180 ; affected 3.1.0 < 3.1.0.356 ; affected 3.2.0 < 3.2.0.460 ; affected 3.2.1 < 3.2.1.79 |
| WSO2 · WSO2 Open Banking AM | unknown 0 < 1.4.0 ; affected 1.4.0 < 1.4.0.143 ; affected 1.5.0 < 1.5.0.144 ; affected 2.0.0 < 2.0.0.405 |
| WSO2 · WSO2 Open Banking IAM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.425 |
| WSO2 · WSO2 Traffic Manager | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.43 ; affected 4.6.0 < 4.6.0.8 |
| WSO2 · WSO2 Universal Gateway | affected 4.5.0 < 4.5.0.43 ; affected 4.5.0 < 4.5.0.44 ; affected 4.6.0 < 4.6.0.8 |
| WSO2 · WSO2 API Control Plane | affected 4.5.0 < 4.5.0.45 ; affected 4.6.0 < 4.6.0.9 |
| WSO2 · WSO2 Identity Server as Key Manager | unknown 0 < 5.7.0 ; affected 5.7.0 < 5.7.0.129 ; affected 5.9.0 < 5.9.0.179 ; affected 5.10.0 < 5.10.0.376 |
| WSO2 · WSO2 Open Banking KM | unknown 0 < 1.4.0 ; affected 1.4.0 < 1.4.0.137 ; affected 1.5.0 < 1.5.0.127 |
| WSO2 · WSO2 Carbon Identity Application Authentication Framework | affected 5.12.153 < 5.12.153.66 ; affected 5.12.387 < 5.12.387.48 ; affected 5.14.97 < 5.14.97.94 ; affected 5.17.5 < 5.17.5.337 ; affected 5.17.118 < 5.17.118.24 ; affected 5.18.187 < 5.18.187.334 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |