Skip to content
Fencer Vulns
critical 9.4

CVE-2025-15039 json

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

published 2026-08-06 3 mo ago modified 2026-09-29 40 d ago also EUVD-2025-210632

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.

Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Patch / fix

  • WSO2 WSO2 Identity Server 5.7.0.130, 5.8.0.113, 5.9.0.173, 5.10.0.385, 5.11.0.432, 6.0.0.259, 6.1.0.260, 7.0.0.138, 7.1.0.45, 7.1.0.49, 7.2.0.7
  • WSO2 WSO2 API Manager 2.6.0.150, 3.0.0.180, 3.1.0.356, 3.2.0.460, 3.2.1.79, 4.0.0.381, 4.1.0.244, 4.2.0.184, 4.3.0.95, 4.4.0.59, 4.5.0.44, 4.6.0.8
  • WSO2 WSO2 Open Banking AM 1.4.0.143, 1.5.0.144, 2.0.0.405
  • WSO2 WSO2 Open Banking IAM 2.0.0.425
  • WSO2 WSO2 Traffic Manager 4.5.0.43, 4.6.0.8
  • WSO2 WSO2 Universal Gateway 4.5.0.43, 4.5.0.44, 4.6.0.8
  • WSO2 WSO2 API Control Plane 4.5.0.45, 4.6.0.9
  • WSO2 WSO2 Identity Server as Key Manager 5.7.0.129, 5.9.0.179, 5.10.0.376
  • WSO2 WSO2 Open Banking KM 1.4.0.137, 1.5.0.127
  • WSO2 WSO2 Carbon Identity Application Authentication Framework 5.12.153.66, 5.12.387.48, 5.14.97.94, 5.17.5.337, 5.17.118.24, 5.18.187.334, 5.18.248.34, 5.23.8.221, 5.24.8.29, 5.25.92.177, 5.25.705.23, 5.25.713.12, 5.25.724.8, 5.25.736.3, 5.25.738, 7.0.78.171, 7.8.23.95, 7.8.586.21, 7.8.646

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

  • WSO2 WSO2 Identity Server
  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 Open Banking IAM
  • WSO2 WSO2 Traffic Manager
  • WSO2 WSO2 Universal Gateway
  • WSO2 WSO2 API Control Plane
  • WSO2 WSO2 Identity Server as Key Manager
  • WSO2 WSO2 Open Banking KM
  • WSO2 WSO2 Carbon Identity Application Authentication Framework

Classification

Weakness
  • CWE-693 Protection Mechanism Failure

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.