CVE-2025-15039: The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific…

PriorityP270critical9.4CVSS 3.1

AVNACLPRNUINSUCHIHAL

EPSS

0.67%

50.9th percentile

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Affected

93 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.45	4.5.0.45
wso2	api_control_plane	>= 4.6.0 < 4.6.0.9	4.6.0.9
wso2	api_manager	>= 2.6.0 < 2.6.0.150	2.6.0.150
wso2	api_manager	>= 3.0.0 < 3.0.0.180	3.0.0.180
wso2	api_manager	>= 3.1.0 < 3.1.0.356	3.1.0.356
wso2	api_manager	>= 3.2.0 < 3.2.0.460	3.2.0.460
wso2	api_manager	>= 3.2.1 < 3.2.1.79	3.2.1.79
wso2	api_manager	>= 4.0.0 < 4.0.0.381	4.0.0.381
wso2	api_manager	>= 4.1.0 < 4.1.0.244	4.1.0.244
wso2	api_manager	>= 4.2.0 < 4.2.0.184	4.2.0.184
wso2	api_manager	>= 4.3.0 < 4.3.0.95	4.3.0.95
wso2	api_manager	>= 4.4.0 < 4.4.0.59	4.4.0.59
wso2	api_manager	>= 4.5.0 < 4.5.0.44	4.5.0.44
wso2	api_manager	>= 4.6.0 < 4.6.0.8	4.6.0.8
wso2	identity_server	>= 5.10.0 < 5.10.0.385	5.10.0.385
wso2	identity_server	>= 5.11.0 < 5.11.0.432	5.11.0.432
wso2	identity_server	>= 5.7.0 < 5.7.0.130	5.7.0.130
wso2	identity_server	>= 5.8.0 < 5.8.0.133	5.8.0.133
wso2	identity_server	>= 5.9.0 < 5.9.0.173	5.9.0.173
wso2	identity_server	>= 6.0.0 < 6.0.0.259	6.0.0.259
wso2	identity_server	>= 6.1.0 < 6.1.0.260	6.1.0.260
wso2	identity_server	>= 7.0.0 < 7.0.0.138	7.0.0.138
wso2	identity_server	>= 7.1.0 < 7.1.0.49	7.1.0.49
wso2	identity_server	>= 7.2.0 < 7.2.0.7	7.2.0.7
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.376	5.10.0.376

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.