WSO2 Identity Server CVE-2025-15039

Exploitation is possible only when all of the following hold: the application's login flow includes a specific secondary authenticator; the Conditional/Adaptive Authentication script is configured with particular event callbacks and re-executes an authentication step; the targeted user is enrolled in one of the impacted authenticators; and the attacker successfully completes every preceding authentication step before the bypassed challenge. These are strong limiting factors - a default configuration without this exact adaptive-script/callback/re-execution pattern is not exploitable, and the attack is inherently targeted at users enrolled in the affected authenticator rather than usable against arbitrary accounts. This is not 'remote unauthenticated exploitation against a default configuration'; it is a configuration- and enrollment-dependent MFA-step bypass.

The reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L, 9.4) indicates a remotely reachable, low-complexity, no-privilege authentication bypass with high confidentiality and integrity impact - on paper a top-priority issue. However, the description materially qualifies this: exploitation requires a conjunction of preconditions (a specific secondary authenticator in the login flow, an Adaptive Authentication script configured with particular event callbacks that re-executes a step, the targeted user enrolled in an impacted authenticator, and the attacker having completed all preceding steps). That conjunction argues the real-world attack complexity is higher than AC:L suggests and that PR:N understates the fact that the attacker must already progress through earlier authentication stages - so this behaves more like a targeted, configuration-dependent bypass than an untargeted internet-wide exploit. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation or automatability; treat this as high-severity-but-conditional. Defenders should prioritize based on whether their own login flows actually use the vulnerable adaptive-script pattern rather than on the 9.4 score alone.

An attacker targeting a specific high-value account initiates login against a WSO2-protected application whose adaptive-auth script re-executes a step with the affected callbacks, completes the earlier authentication stages, and then manipulates the callback/re-execution behavior so the intermediate MFA challenge (the impacted secondary authenticator) is skipped, landing an authenticated session as the victim. No public exploit code is identified at time of analysis, so this would require an attacker with knowledge of the target's specific adaptive-script configuration. Given AV:N the attack is performed remotely over the network against the login flow.