WaratekVRT Sign in

CVE-2025-15039

Affected software3 products, listed below
Severity9.4 Critical CVSS 3.1
WeaknessCWE-693
Published6 Aug 2026
Updated29 Sep 2026

Description

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

Exploitation status

No public exploit

No exploit has been reported in the sources we check.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.67% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review automated Upstream data
  • Record active
Decided by Nothing to build a rule from yet: no published exploit, no CISA record of exploitation and no source-level change to read
Finding This CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

Affected software and releases

Products and versions

9 products, 37 version entries
SourceVendorProductSchemeAffected versions
nvd wso2 api control plane generic ≥ 4.5.0 and ＜ 4.5.0.45 · ≥ 4.6.0 and ＜ 4.6.0.9
nvd wso2 api manager generic ≥ 2.6.0 and ＜ 2.6.0.150 · ≥ 3.0.0 and ＜ 3.0.0.180 · ≥ 3.1.0 and ＜ 3.1.0.356 · ≥ 3.2.0 and ＜ 3.2.0.460 · ≥ 3.2.1 and ＜ 3.2.1.79 · ≥ 4.0.0 and ＜ 4.0.0.381 · ≥ 4.1.0 and ＜ 4.1.0.244 · ≥ 4.2.0 and ＜ 4.2.0.184 · ≥ 4.3.0 and ＜ 4.3.0.95 · ≥ 4.4.0 and ＜ 4.4.0.59 · ≥ 4.5.0 and ＜ 4.5.0.44 · ≥ 4.6.0 and ＜ 4.6.0.8
nvd wso2 identity server generic ≥ 5.7.0 and ＜ 5.7.0.130 · ≥ 5.8.0 and ＜ 5.8.0.133 · ≥ 5.9.0 and ＜ 5.9.0.173 · ≥ 5.10.0 and ＜ 5.10.0.385 · ≥ 5.11.0 and ＜ 5.11.0.432 · ≥ 6.0.0 and ＜ 6.0.0.259 · ≥ 6.1.0 and ＜ 6.1.0.260 · ≥ 7.0.0 and ＜ 7.0.0.138 · ≥ 7.1.0 and ＜ 7.1.0.49 · ≥ 7.2.0 and ＜ 7.2.0.7
nvd wso2 identity server as key manager generic ≥ 5.7.0 and ＜ 5.7.0.129 · ≥ 5.9.0 and ＜ 5.9.0.179 · ≥ 5.10.0 and ＜ 5.10.0.376
nvd wso2 open banking am generic ≥ 1.4.0 and ＜ 1.4.0.143 · ≥ 1.5.0 and ＜ 1.5.0.144 · ≥ 2.0.0 and ＜ 2.0.0.405
nvd wso2 open banking iam generic ≥ 2.0.0 and ＜ 2.0.0.425
nvd wso2 open banking km generic ≥ 1.4.0 and ＜ 1.4.0.137 · ≥ 1.5.0 and ＜ 1.5.0.127
nvd wso2 traffic manager generic ≥ 4.5.0 and ＜ 4.5.0.43 · ≥ 4.6.0 and ＜ 4.6.0.8
nvd wso2 universal gateway generic ≥ 4.5.0 and ＜ 4.5.0.44 · ≥ 4.6.0 and ＜ 4.6.0.8

References

URLTags
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/ Vendor Advisory

Timeline
Published2026-08-06By the CVE Program.
NVD record modified2026-09-29NVD's own last-modified date for this record.