Skip to content
Fencer Intel
critical 9.4

CVE-2025-15039 json

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

published 3mo ago modified last mo. also EUVD-2025-210632

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps.

Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Patch / fix

  • WSO2 WSO2 Identity Server 5.7.0.130, 5.8.0.113, 5.9.0.173, 5.10.0.385, 5.11.0.432, 6.0.0.259, 6.1.0.260, 7.0.0.138, 7.1.0.45, 7.1.0.49, 7.2.0.7
  • WSO2 WSO2 API Manager 2.6.0.150, 3.0.0.180, 3.1.0.356, 3.2.0.460, 3.2.1.79, 4.0.0.381, 4.1.0.244, 4.2.0.184, 4.3.0.95, 4.4.0.59, 4.5.0.44, 4.6.0.8
  • WSO2 WSO2 Open Banking AM 1.4.0.143, 1.5.0.144, 2.0.0.405
  • WSO2 WSO2 Open Banking IAM 2.0.0.425
  • WSO2 WSO2 Traffic Manager 4.5.0.43, 4.6.0.8
  • WSO2 WSO2 Universal Gateway 4.5.0.43, 4.5.0.44, 4.6.0.8
  • WSO2 WSO2 API Control Plane 4.5.0.45, 4.6.0.9
  • WSO2 WSO2 Identity Server as Key Manager 5.7.0.129, 5.9.0.179, 5.10.0.376
  • WSO2 WSO2 Open Banking KM 1.4.0.137, 1.5.0.127
  • WSO2 WSO2 Carbon Identity Application Authentication Framework 5.12.153.66, 5.12.387.48, 5.14.97.94, 5.17.5.337, 5.17.118.24, 5.18.187.334, 5.18.248.34, 5.23.8.221, 5.24.8.29, 5.25.92.177, 5.25.705.23, 5.25.713.12, 5.25.724.8, 5.25.736.3, 5.25.738, 7.0.78.171, 7.8.23.95, 7.8.586.21, 7.8.646

Is CVE-2025-15039 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
3mo ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

  • WSO2 WSO2 Identity Server
  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 Open Banking IAM
  • WSO2 WSO2 Traffic Manager
  • WSO2 WSO2 Universal Gateway
  • WSO2 WSO2 API Control Plane
  • WSO2 WSO2 Identity Server as Key Manager
  • WSO2 WSO2 Open Banking KM
  • WSO2 WSO2 Carbon Identity Application Authentication Framework

Classification

Weakness
  • CWE-693 Protection Mechanism Failure

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.