Veille CVE

Août 2026

2 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WSO2 Carbon Identity Application Authentication Framework » ✕
  1. CVE-2025-15039 9.4 Critique

    WSO2 Identity Server · WSO2 API Manager · WSO2 Open Banking AM · WSO2 Open Banking IAM

    The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

  2. CVE-2025-13909 4.3 Moyenne

    WSO2 Identity Server · WSO2 Carbon Identity Application Authentication Framework · WSO2 Carbon MagicLink Authenticator Module · WSO2 Carbon Abstract OTP Authenticator

    The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.