CVE-2025-15039
Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
How to fix
- wso2 api_control_plane4.5.0.45, 4.6.0.9 or later
- wso2 api_manager2.6.0.150, 3.0.0.180, 3.1.0.356, 3.2.0.460, 3.2.1.79, 4.0.0.381, 4.1.0.244, 4.2.0.184, 4.3.0.95, 4.4.0.59, 4.5.0.44, 4.6.0.8 or later
- wso2 identity_server5.7.0.130, 5.8.0.133, 5.9.0.173, 5.10.0.385, 5.11.0.432, 6.0.0.259, 6.1.0.260, 7.0.0.138, 7.1.0.49, 7.2.0.7 or later
- wso2 identity_server_as_key_manager5.7.0.129, 5.9.0.179, 5.10.0.376 or later
- wso2 open_banking_am1.4.0.143, 1.5.0.144, 2.0.0.405 or later
- wso2 open_banking_iam2.0.0.425 or later
- wso2 open_banking_km1.4.0.137, 1.5.0.127 or later
- wso2 traffic_manager4.5.0.43, 4.6.0.8 or later
- wso2 universal_gateway4.5.0.44, 4.6.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_control_plane | 4.5.0 ≤ v < 4.5.0.45, 4.6.0 ≤ v < 4.6.0.9 | 4.5.0.45, 4.6.0.9 |
| wso2 api_manager | 2.6.0 ≤ v < 2.6.0.150, 3.0.0 ≤ v < 3.0.0.180, 3.1.0 ≤ v < 3.1.0.356, 3.2.0 ≤ v < 3.2.0.460, 3.2.1 ≤ v < 3.2.1.79, 4.0.0 ≤ v < 4.0.0.381, 4.1.0 ≤ v < 4.1.0.244, 4.2.0 ≤ v < 4.2.0.184, 4.3.0 ≤ v < 4.3.0.95, 4.4.0 ≤ v < 4.4.0.59, 4.5.0 ≤ v < 4.5.0.44, 4.6.0 ≤ v < 4.6.0.8 | 2.6.0.150, 3.0.0.180, 3.1.0.356, 3.2.0.460, 3.2.1.79, 4.0.0.381, 4.1.0.244, 4.2.0.184, 4.3.0.95, 4.4.0.59, 4.5.0.44, 4.6.0.8 |
| wso2 identity_server | 5.7.0 ≤ v < 5.7.0.130, 5.8.0 ≤ v < 5.8.0.133, 5.9.0 ≤ v < 5.9.0.173, 5.10.0 ≤ v < 5.10.0.385, 5.11.0 ≤ v < 5.11.0.432, 6.0.0 ≤ v < 6.0.0.259, 6.1.0 ≤ v < 6.1.0.260, 7.0.0 ≤ v < 7.0.0.138, 7.1.0 ≤ v < 7.1.0.49, 7.2.0 ≤ v < 7.2.0.7 | 5.7.0.130, 5.8.0.133, 5.9.0.173, 5.10.0.385, 5.11.0.432, 6.0.0.259, 6.1.0.260, 7.0.0.138, 7.1.0.49, 7.2.0.7 |
| wso2 identity_server_as_key_manager | 5.7.0 ≤ v < 5.7.0.129, 5.9.0 ≤ v < 5.9.0.179, 5.10.0 ≤ v < 5.10.0.376 | 5.7.0.129, 5.9.0.179, 5.10.0.376 |
| wso2 open_banking_am | 1.4.0 ≤ v < 1.4.0.143, 1.5.0 ≤ v < 1.5.0.144, 2.0.0 ≤ v < 2.0.0.405 | 1.4.0.143, 1.5.0.144, 2.0.0.405 |
| wso2 open_banking_iam | 2.0.0 ≤ v < 2.0.0.425 | 2.0.0.425 |
| wso2 open_banking_km | 1.4.0 ≤ v < 1.4.0.137, 1.5.0 ≤ v < 1.5.0.127 | 1.4.0.137, 1.5.0.127 |
| wso2 traffic_manager | 4.5.0 ≤ v < 4.5.0.43, 4.6.0 ≤ v < 4.6.0.8 | 4.5.0.43, 4.6.0.8 |
| wso2 universal_gateway | 4.5.0 ≤ v < 4.5.0.44, 4.6.0 ≤ v < 4.6.0.8 | 4.5.0.44, 4.6.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.