Conditional Authentication User And Roles Related Functions
Monthly
Adaptive authentication flows in WSO2 Identity Server 7.1.0 (up to 7.1.0.26) and the Conditional Authentication User and Roles Related Functions module 1.2.76 (up to 1.2.76.1) fail to validate the organization context in which they execute, allowing authentication logic configured for one organization to run against other organizations and sub-organizations. An attacker who already holds privileges to configure adaptive authentication within at least one tenant can therefore cross tenant authorization boundaries to perform critical operations, escalate privileges, and potentially take over accounts in other organizations - an authenticated, high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N) that limits the realistic attacker set to insiders or compromised tenant administrators. Exploitation requires a multi-organization deployment with adaptive authentication enabled; EPSS is low at 0.02% (6th percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis, though the vendor rates technical impact as total.
Adaptive authentication flows in WSO2 Identity Server 7.1.0 (up to 7.1.0.26) and the Conditional Authentication User and Roles Related Functions module 1.2.76 (up to 1.2.76.1) fail to validate the organization context in which they execute, allowing authentication logic configured for one organization to run against other organizations and sub-organizations. An attacker who already holds privileges to configure adaptive authentication within at least one tenant can therefore cross tenant authorization boundaries to perform critical operations, escalate privileges, and potentially take over accounts in other organizations - an authenticated, high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N) that limits the realistic attacker set to insiders or compromised tenant administrators. Exploitation requires a multi-organization deployment with adaptive authentication enabled; EPSS is low at 0.02% (6th percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis, though the vendor rates technical impact as total.