CVE-2025-15039

Published Aug 6, 2026

Last updated 6 days ago

CVSS critical 9.4

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-15039 describes a vulnerability found in the Conditional Authentication (Adaptive Authentication) script used across several WSO2 products, including API Control Plane, API Manager, Carbon Identity Application Authentication Framework, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager, and Universal Gateway. This flaw allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation of CVE-2025-15039 can lead to unauthorized access to a targeted user account. This vulnerability is exploitable under specific conditions: the application's login flow must include a particular secondary authenticator, the Conditional Authentication script needs to be configured with specific event callbacks and re-execute an authentication step, the targeted user must have one of the impacted authenticators enrolled, and the attacker must successfully complete any preceding authentication steps.

Description
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
Source
ed10eef1-636d-4fbe-9993-6890dfa878f8
NVD status
Analyzed
Products
api_control_plane, api_manager, identity_server, identity_server_as_key_manager, open_banking_am, open_banking_iam, open_banking_km, traffic_manager, universal_gateway

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.4
Impact score
5.5
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Severity
CRITICAL

Weaknesses

ed10eef1-636d-4fbe-9993-6890dfa878f8
CWE-693

Social media

Hype score
Not currently trending

  1. CVE-2025-15039 WSO2 Identity Server Authentication bypass could enable account takeover in identity systems used for citizen services, open banking and enterprise access control Full analysis: https://t.co/Tv1IqHsfr8 #CyberSecurity #IdentitySecurity #VulnerabilityManagement

    @TuringCyberObs

    10 Aug 2026

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨*CVE* CVE-2025-15039 The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-s… https://t.co/bQTykUs8qX ----- Traducción: CVE-2025-15039 El … https://t.co/utmtNg

    @infoflowcloud

    6 Aug 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-15039 The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-s… https://t.co/n7lbLYlIiX

    @CVEnew

    6 Aug 2026

    1803 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.•CVE-2025-12737
  2. The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification. Successful exploitation could allow an attacker to predict shared secrets used for Webhook HMAC validation and forge event payloads with valid signatures. This may enable bypassing API Gateway authenticity checks, leading to unauthorized event injection, data manipulation, or downstream system compromise.•CVE-2026-3416
  3. WSO2 Multiple Products Path Traversal Vulnerability •CVE-2026-5430
  4. Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.•CVE-2026-1728
  5. When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.•CVE-2026-0637

References

Sources include official advisories and independent security research.