EUVD-2025-210632
GHSA-76r4-x438-gm5w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Remote via login endpoint (AV:N) and no standing privileges (PR:N), but the required specific adaptive-script/callback/re-execution config plus completing preceding steps against an enrolled user justifies AC:H.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
3DescriptionCVE.org
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.
Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
AnalysisAI
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Technical ContextAI
The affected component is WSO2's Carbon Identity Application Authentication Framework, which powers Conditional (Adaptive) Authentication - JavaScript-based scripts that let operators define dynamic, multi-step login flows (e.g. step-up MFA based on risk or user attributes). Exploitation abuses how this scripting engine processes authenticator callbacks and re-executes authentication steps within a specific multi-step pattern, so an intermediate authenticator challenge is treated as satisfied without actually being completed. The root cause maps to CWE-693 (Protection Mechanism Failure): the security control (MFA step enforcement) is present but is not correctly applied under this configuration, so it can be circumvented rather than being outright absent. The CPE data shows the same identity/auth framework is embedded across WSO2 Identity Server, API Manager, the Open Banking suite, Traffic Manager, Universal Gateway, API Control Plane, and Identity Server as Key Manager, meaning the shared framework flaw propagates to every product bundling it.
RemediationAI
Apply the vendor remediation described in WSO2 security advisory WSO2-2025-4973 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/ (patch available per vendor advisory; an exact fixed version is not stated in the provided data, so obtain the correct WUM/update or patched release for your specific product and version from that advisory). As a compensating control until patched, review and reconfigure Conditional/Adaptive Authentication scripts to eliminate the vulnerable pattern - specifically avoid script logic that re-executes an authentication step in combination with the affected event callbacks, and restructure multi-step flows so intermediate authenticators cannot be short-circuited; the trade-off is that some adaptive step-up or risk-based flows may need to be simplified or temporarily disabled, reducing dynamic policy flexibility. Additionally restrict which users/tenants have the impacted authenticators enrolled and audit accounts that could be targeted. Do not rely on network controls alone since the framework is exposed via the standard login endpoints.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attac
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today