WSO2 Identity Server EUVD-2025-209762

Exploitation requires a multi-organization (multi-tenant) WSO2 Identity Server deployment with adaptive authentication enabled, AND the attacker must hold privileges to configure adaptive authentication within at least one organization (PR:H) - a tenant-level administrative capability, not an anonymous role. The specific defect is missing validation of the organization context when adaptive authentication flows execute, so a flow configured in one org runs against other orgs and sub-orgs. Limiting factors: single-organization deployments and deployments that do not use adaptive authentication are not exposed; no user interaction is needed (UI:N) but the high privilege prerequisite substantially narrows the realistic attacker set to insiders or already-compromised admin accounts.

Signals point to a real but moderate-priority, high-barrier flaw rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) requires PR:H - the attacker must already hold privileges to configure adaptive authentication within an organization, so this is a trusted-insider or compromised-admin escalation path, not an anonymous internet attack. CISA SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=total. EPSS is 0.02% (6th percentile), consistent with no public exploit and the high privilege precondition. The vulnerability is NOT in CISA KEV and no POC is referenced. The one notable tension: impact is total/cross-organizational (authorization-boundary bypass affecting other orgs and sub-orgs), which arguably warrants a scope change (S:C), yet the vendor/NVD vector uses S:U - treat the 7.2 as possibly conservative given the cross-tenant blast radius. Overall: genuine authorization/multi-tenancy defect worth patching on IAM infrastructure, but low likelihood of opportunistic widespread exploitation because of the PR:H gate.

A tenant administrator (or an attacker who has compromised such an account) in a multi-organization WSO2 Identity Server deployment configures an adaptive authentication script in their own organization. Because the organization context is not validated at execution time, that script's authentication logic is triggered against other organizations and sub-organizations, letting the actor perform privileged operations and take over accounts outside their authorization boundary. No public exploit code is identified at time of analysis; exploitation requires the attacker to already hold adaptive-authentication configuration privileges (PR:H).