CVE-2025-15039

Katalog CVE

CVSS 9.4 · Critical EPSS 0,67%

Kerentanan Protection Mechanism Failure pada wso2 api control plane, wso2 api manager +7 lainnya. Skor CVSS 3.1 9.4 (Critical) menurut CNA.

Deskripsi (NVD)

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

9.4 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/ advisory vendor