CVE-2025-15039

Description

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Traduire en français

Produits concernés

• WSO2 Identity Server
• WSO2 API Manager
• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• WSO2 Traffic Manager
• WSO2 Universal Gateway
• WSO2 API Control Plane
• WSO2 Identity Server as Key Manager
• WSO2 Open Banking KM
• WSO2 Carbon Identity Application Authentication Framework

Scores CVSS

Faiblesses (CWE)

• CWE-693

Références

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/ Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories