The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LWso2 Api Control Plane
APPWso24.5.0 – 4.5.0.45 (excl.)4.6.0 – 4.6.0.9 (excl.)Wso2 Api Manager
APPWso22.6.0 – 2.6.0.150 (excl.)3.0.0 – 3.0.0.180 (excl.)3.1.0 – 3.1.0.356 (excl.)3.2.0 – 3.2.0.460 (excl.)3.2.1 – 3.2.1.79 (excl.)4.0.0 – 4.0.0.381 (excl.)4.1.0 – 4.1.0.244 (excl.)4.2.0 – 4.2.0.184 (excl.)4.3.0 – 4.3.0.95 (excl.)4.4.0 – 4.4.0.59 (excl.)4.5.0 – 4.5.0.44 (excl.)4.6.0 – 4.6.0.8 (excl.)Wso2 Identity Server
APPWso25.7.0 – 5.7.0.130 (excl.)5.8.0 – 5.8.0.133 (excl.)5.9.0 – 5.9.0.173 (excl.)5.10.0 – 5.10.0.385 (excl.)5.11.0 – 5.11.0.432 (excl.)6.0.0 – 6.0.0.259 (excl.)6.1.0 – 6.1.0.260 (excl.)7.0.0 – 7.0.0.138 (excl.)7.1.0 – 7.1.0.49 (excl.)7.2.0 – 7.2.0.7 (excl.)Wso2 Identity Server As Key Manager
APPWso25.7.0 – 5.7.0.129 (excl.)5.9.0 – 5.9.0.179 (excl.)5.10.0 – 5.10.0.376 (excl.)Wso2 Open Banking Am
APPWso21.4.0 – 1.4.0.143 (excl.)1.5.0 – 1.5.0.144 (excl.)2.0.0 – 2.0.0.405 (excl.)Wso2 Open Banking Iam
APPWso22.0.0 – 2.0.0.425 (excl.)Wso2 Open Banking Km
APPWso21.4.0 – 1.4.0.137 (excl.)1.5.0 – 1.5.0.127 (excl.)Wso2 Traffic Manager
APPWso24.5.0 – 4.5.0.43 (excl.)4.6.0 – 4.6.0.8 (excl.)Wso2 Universal Gateway
APPWso24.5.0 – 4.5.0.44 (excl.)4.6.0 – 4.6.0.8 (excl.)
Related vulnerabilities
WSO2 — nieograniczony upload plików i RCE przez path traversal
WSO2: niedostateczne ograniczenia tokenów użytkowników — dostęp do Admin REST API
Błąd weryfikacji algorytmu JWT umożliwia nieautoryzowany dostęp (WSO2)
WSO2 API Manager – RCE przez upload pliku z uprawnieniami administratora
Brak wymuszania uwierzytelniania mTLS w produktach WSO2 — nieautoryzowany dostęp administracyjny