Read the docs
TI-2025-09153 Aliases CVE-2025-9973GHSA-xm8v-8xxf-7x94

Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

Priority LOW 34CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive authentication within one organization can leverage this functionality to execute authentication logic on other organizations and sub-organizations. This flaw allows bypassing authorization boundaries between organizations, leading to unauthorized access to critical operations and user accounts in other organizations. When adaptive authentication is enabled in a multi-organization deployment, a malicious actor with privileges to configure adaptive authentication in one organization could exploit this feature to perform critical operations in other organizations without authorization. This may result in privilege escalation, unauthorized access to resources, and potential account takeover across organizations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server (WSO2): 7.1.0.26Conditional Authentication User and Roles Related Functions (WSO2): 1.2.76.1, 1.2.82

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Identity Server7.1.0 to before 7.1.0.267.1.0.26Patch availableCNA
WSO2Conditional Authentication User and Roles Related Functions1.2.76 to before 1.2.76.11.2.76.1, 1.2.82Patch availableCNA
  • WSO2 Identity Server VendorWSO2 Affected 7.1.0 to before 7.1.0.26 Fixed in 7.1.0.26 Patch available CNA
  • Conditional Authentication User and Roles Related Functions VendorWSO2 Affected 1.2.76 to before 1.2.76.1 Fixed in 1.2.76.1, 1.2.82 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*7.1.0 to before 7.1.0.26VulnerableWSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.0.26 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 7.1.0.26
  • Fix · CNA Conditional Authentication User and Roles Related Functions (WSO2) Fixed in 1.2.76.1, 1.2.82

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9973
  2. 2026-10-03 Alias added: GHSA-xm8v-8xxf-7x94

References

Advisory 1

  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2018-06290 WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. CVSS 3.0MEDIUM 5.4
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2024-06413 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover CVSS 3.1CRITICAL 9.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences