NetSight
IP …
critical9.4

CVE-2025-15039

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific …

Impact

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Affected products

VendorProductAffected versions
Wso2Api Control Plane
from 4.5.0 before 4.5.0.45
from 4.6.0 before 4.6.0.9
Wso2Api Manager
from 2.6.0 before 2.6.0.150
from 3.0.0 before 3.0.0.180
from 3.1.0 before 3.1.0.356
from 3.2.0 before 3.2.0.460
from 3.2.1 before 3.2.1.79
from 4.0.0 before 4.0.0.381
Wso2Identity Server
from 5.7.0 before 5.7.0.130
from 5.8.0 before 5.8.0.133
from 5.9.0 before 5.9.0.173
from 5.10.0 before 5.10.0.385
from 5.11.0 before 5.11.0.432
from 6.0.0 before 6.0.0.259
Wso2Identity Server As Key Manager
from 5.7.0 before 5.7.0.129
from 5.9.0 before 5.9.0.179
from 5.10.0 before 5.10.0.376
Wso2Open Banking Am
from 1.4.0 before 1.4.0.143
from 1.5.0 before 1.5.0.144
from 2.0.0 before 2.0.0.405
Wso2Open Banking Iam
from 2.0.0 before 2.0.0.425
Wso2Open Banking Km
from 1.4.0 before 1.4.0.137
from 1.5.0 before 1.5.0.127
Wso2Traffic Manager
from 4.5.0 before 4.5.0.43
from 4.6.0 before 4.6.0.8
Wso2Universal Gateway
from 4.5.0 before 4.5.0.44
from 4.6.0 before 4.6.0.8

Weakness classification

CWE-693

References