What’s Vulnerable › Vulnerabilities

CVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

Description

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Affected products

How to fix

Upgrade to a fixed version: WSO2 Api Control Plane 4.5.0.45, 4.6.0.9; WSO2 API Manager 2.6.0.150, 3.0.0.180, 3.1.0.356, 3.2.0.460; WSO2 Identity Server 5.10.0.385, 5.11.0.432, 5.7.0.130, 5.8.0.133; WSO2 Identity Server As Key Manager 5.10.0.376, 5.7.0.129, 5.9.0.179; WSO2 Open Banking Am 1.4.0.143, 1.5.0.144, 2.0.0.405; WSO2 Open Banking Iam 2.0.0.425; WSO2 Open Banking Km 1.4.0.137, 1.5.0.127; WSO2 Traffic Manager 4.5.0.43, 4.6.0.8; WSO2 Universal Gateway 4.5.0.44, 4.6.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-15039 or the next vulnerability affects your stack