CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Updated under an hour ago ()
Does this affect you?
It affects WSO2 Identity Server and 9 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
- CVSS
- 9.4 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- Weakness (CWE)
- CWE-693
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WSO2
- NVD analysis
- Analyzed
- Record last updated
- Aug 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
WSO2 WSO2 Identity Server wso2:identity_server (from the name) | before 5.7.0 status unknown; from 5.7.0 before 5.7.0.130; from 5.8.0 before 5.8.0.113; from 5.9.0 before 5.9.0.173; from 5.10.0 before 5.10.0.385; from 5.11.0 before 5.11.0.432; from 6.0.0 before 6.0.0.259; from 6.1.0 before 6.1.0.260; and 4 more ranges | CNA record |
WSO2 WSO2 API Manager wso2:api_manager (from the name) | before 2.6.0 status unknown; from 2.6.0 before 2.6.0.150; from 3.0.0 before 3.0.0.180; from 3.1.0 before 3.1.0.356; from 3.2.0 before 3.2.0.460; from 3.2.1 before 3.2.1.79; from 4.0.0 before 4.0.0.381; from 4.1.0 before 4.1.0.244; and 5 more ranges | CNA record |
WSO2 WSO2 Open Banking AM wso2:open_banking_am (from the name) | before 1.4.0 status unknown; from 1.4.0 before 1.4.0.143; from 1.5.0 before 1.5.0.144; from 2.0.0 before 2.0.0.405 | CNA record |
WSO2 WSO2 Open Banking IAM wso2:open_banking_iam (from the name) | before 2.0.0 status unknown; from 2.0.0 before 2.0.0.425 | CNA record |
WSO2 WSO2 Traffic Manager wso2:traffic_manager (from the name) | before 4.5.0 status unknown; from 4.5.0 before 4.5.0.43; from 4.6.0 before 4.6.0.8 | CNA record |
WSO2 WSO2 Universal Gateway wso2:universal_gateway (from the name) | from 4.5.0 before 4.5.0.43; from 4.5.0 before 4.5.0.44; from 4.6.0 before 4.6.0.8 | CNA record |
WSO2 WSO2 API Control Plane wso2:api_control_plane (from the name) | from 4.5.0 before 4.5.0.45; from 4.6.0 before 4.6.0.9 | CNA record |
WSO2 WSO2 Identity Server as Key Manager wso2:identity_server_as_key_manager (from the name) | before 5.7.0 status unknown; from 5.7.0 before 5.7.0.129; from 5.9.0 before 5.9.0.179; from 5.10.0 before 5.10.0.376 | CNA record |
WSO2 WSO2 Open Banking KM wso2:open_banking_km (from the name) | before 1.4.0 status unknown; from 1.4.0 before 1.4.0.137; from 1.5.0 before 1.5.0.127 | CNA record |
WSO2 WSO2 Carbon Identity Application Authentication Framework wso2:carbon_identity_application_authentication_framework (from the name) | from 5.12.153 before 5.12.153.66; from 5.12.387 before 5.12.387.48; from 5.14.97 before 5.14.97.94; from 5.17.5 before 5.17.5.337; from 5.17.118 before 5.17.118.24; from 5.18.187 before 5.18.187.334; from 5.18.248 before 5.18.248.34; from 5.23.8 before 5.23.8.221; and 11 more ranges | CNA record |
wso2 api_control_plane wso2:api_control_plane | from 4.5.0 before 4.5.0.45; from 4.6.0 before 4.6.0.9 | NVD |
wso2 api_manager wso2:api_manager | from 2.6.0 before 2.6.0.150; from 3.0.0 before 3.0.0.180; from 3.1.0 before 3.1.0.356; from 3.2.0 before 3.2.0.460; from 3.2.1 before 3.2.1.79; from 4.0.0 before 4.0.0.381; from 4.1.0 before 4.1.0.244; from 4.2.0 before 4.2.0.184; and 4 more ranges | NVD |
wso2 identity_server wso2:identity_server | from 5.7.0 before 5.7.0.130; from 5.8.0 before 5.8.0.133; from 5.9.0 before 5.9.0.173; from 5.10.0 before 5.10.0.385; from 5.11.0 before 5.11.0.432; from 6.0.0 before 6.0.0.259; from 6.1.0 before 6.1.0.260; from 7.0.0 before 7.0.0.138; and 2 more ranges | NVD |
wso2 identity_server_as_key_manager wso2:identity_server_as_key_manager | from 5.7.0 before 5.7.0.129; from 5.9.0 before 5.9.0.179; from 5.10.0 before 5.10.0.376 | NVD |
wso2 open_banking_am wso2:open_banking_am | from 1.4.0 before 1.4.0.143; from 1.5.0 before 1.5.0.144; from 2.0.0 before 2.0.0.405 | NVD |
wso2 open_banking_iam wso2:open_banking_iam | from 2.0.0 before 2.0.0.425 | NVD |
wso2 open_banking_km wso2:open_banking_km | from 1.4.0 before 1.4.0.137; from 1.5.0 before 1.5.0.127 | NVD |
wso2 traffic_manager wso2:traffic_manager | from 4.5.0 before 4.5.0.43; from 4.6.0 before 4.6.0.8 | NVD |
wso2 universal_gateway wso2:universal_gateway | from 4.5.0 before 4.5.0.44; from 4.6.0 before 4.6.0.8 | NVD |
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.