Security Advisory WSO2-2025-4973/CVE-2025-15039

Published: 2026-01-23

Version: 1.0.0

Severity: Critical

CVSS Score: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

CVE IDs: CVE-2025-15039

AFFECTED PRODUCTS

  • WSO2 API Control Plane: 4.6.0, 4.5.0
  • WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0, 3.1.0, 3.0.0, 2.6.0
  • WSO2 Identity Server as Key Manager: 5.10.0, 5.9.0, 5.7.0
  • WSO2 Identity Server: 7.2.0, 7.1.0, 7.0.0, 6.1.0, 6.0.0, 5.11.0, 5.10.0, 5.9.0, 5.8.0, 5.7.0
  • WSO2 Open Banking AM: 2.0.0, 1.5.0, 1.4.0
  • WSO2 Open Banking IAM: 2.0.0
  • WSO2 Open Banking KM: 1.5.0, 1.4.0
  • WSO2 Traffic Manager: 4.6.0, 4.5.0
  • WSO2 Universal Gateway: 4.6.0, 4.5.0

OVERVIEW

Potential account takeover via Conditional Authentication (Adaptive Authentication).

DESCRIPTION

When a Conditional Authentication (Adaptive Authentication) script follows a specific multi-step pattern and certain conditions are met, a malicious actor can gain access to user accounts by completing only the initial authentication steps.

Affected WSO2 Products that use Conditional Authentication are impacted if the following conditions are met.

Conditions:

  1. Application login flow contains one of the following authenticators as a secondary step

  2. Authenticators provided by WSO2 Identity Server 7.0.0, 7.1.0, and 7.2.0

    • Passkey Authentication
    • Push Notification Based Authentication
    • iProov Authentication

  3. Any custom authenticators used in the impacted product version

    • A custom authenticator with logic to return any other status than SUCCESS_COMPLETE or INCOMPLETE

  4. The Conditional Authentication script meets both of the following conditions:

  5. The executeStep function for one of the above authenticators, and has defined at least one event callback function, such as onFail,onUserAbort, onFallback, or onSuccess.

  6. The same authentication step is executed again in the script.

  7. The targeted user should have at least one of the aforementioned impacted authenticators available for enrollment.

  8. The malicious actor must complete any prior authentication steps before the vulnerable step.

Example conditional authentication script patterns that are vulnerable.

Affected Pattern 1:

var onLoginRequest = function(context) {
    executeStep(1);
        executeStep(2, {
            onFail: function(context) {
                executeStep(2);
            }
        });
    };

Affected Pattern 2:

var onLoginRequest = function(context) {
    executeStep(1);
        executeStep(2, {
            onFail: function(context) {
                Log.info("Authentication Failure");
                }     
            });
        executeStep(2);
    };

IMPACT

Successful exploitation of this vulnerability would allow a malicious actor to gain access to a targeted account.

SOLUTION

Community Users (Open Source)

Apply the relevant fixes to your product using the public fix(es) provided below.

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders

Update your product to the specified update level, or to a higher update level, to mitigate the identified vulnerability.

Info

WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.

Product Name Product Version Update Level
WSO2 API Control Plane 4.6.0 9
WSO2 API Control Plane 4.5.0 45
WSO2 API Manager 4.6.0 8
WSO2 API Manager 4.5.0 44
WSO2 API Manager 4.4.0 59
WSO2 API Manager 4.3.0 95
WSO2 API Manager 4.2.0 184
WSO2 API Manager 4.1.0 244
WSO2 API Manager 4.0.0 381
WSO2 API Manager 3.2.1 79
WSO2 API Manager 3.2.0 460
WSO2 API Manager 3.1.0 356
WSO2 API Manager 3.0.0 180
WSO2 API Manager 2.6.0 150
WSO2 Identity Server 7.2.0 7
WSO2 Identity Server 7.1.0 49
WSO2 Identity Server 7.0.0 138
WSO2 Identity Server 6.1.0 260
WSO2 Identity Server 6.0.0 259
WSO2 Identity Server 5.11.0 432
WSO2 Identity Server 5.10.0 385
WSO2 Identity Server 5.9.0 173
WSO2 Identity Server 5.8.0 113
WSO2 Identity Server 5.7.0 130
WSO2 Identity Server as Key Manager 5.10.0 376
WSO2 Identity Server as Key Manager 5.9.0 179
WSO2 Identity Server as Key Manager 5.7.0 129
WSO2 Open Banking AM 2.0.0 405
WSO2 Open Banking AM 1.5.0 144
WSO2 Open Banking AM 1.4.0 143
WSO2 Open Banking IAM 2.0.0 425
WSO2 Open Banking KM 1.5.0 127
WSO2 Open Banking KM 1.4.0 137
WSO2 Traffic Manager 4.6.0 8
WSO2 Traffic Manager 4.5.0 43
WSO2 Universal Gateway 4.6.0 8
WSO2 Universal Gateway 4.5.0 44